CVE-2021-40904

The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default), which allows embedded php code. As a result, remote code execution is achieved. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session by a user with the role of administrator.

• CWE-276

• https://github.com/Edgarloyola/CVE-2021-40904Exploit, Patch, Third Party Advisory
• https://github.com/Edgarloyola/CVE-2021-40904Exploit, Patch, Third Party Advisory

Published

Mar 25, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40899A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-4090An out-of-bounds (OOB) memory write flaw was found in the NF…7.1
• CVE-2021-40900A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40901A Regular Expression Denial of Service (ReDOS) vulnerability…7.5
• CVE-2021-40902flatCore-CMS version 2.0.8 is affected by Cross Site Scripti…5.4
• CVE-2021-40903A vulnerability in Antminer Monitor 0.50.0 exists because of…9.8
• CVE-2021-40905The web management console of CheckMK Enterprise Edition (ve…8.8
• CVE-2021-40906CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does …6.1
• CVE-2021-40907SQL injection vulnerability in Sourcecodester Storage Unit R…9.8
• CVE-2021-40908SQL injection vulnerability in Login.php in Sourcecodester P…9.8
• CVE-2021-40909Cross site scripting (XSS) vulnerability in sourcecodester P…9.6
• CVE-2021-4091A double-free was found in the way 389-ds-base handles virtu…7.5