CVE-2021-42580

Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated remote command execution.

• CWE-89

• http://packetstormsecurity.com/files/164985/Online-Learning-System-2.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/DjebbarAnon/online-learning-system-v2-sqli-authentication-bypass-file-upload-unauthenticated-RCEExploit, Third Party Advisory
• https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-07Exploit, Third Party Advisory
• https://www.nu11secur1ty.com/2021/09/cve-nu11-07-elearning-v2by-oretnom23-is.htmlExploit, Third Party Advisory
• https://www.nu11secur1ty.com/2021/11/cve-2021-42580.htmlExploit, Third Party Advisory
• http://packetstormsecurity.com/files/164985/Online-Learning-System-2.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/DjebbarAnon/online-learning-system-v2-sqli-authentication-bypass-file-upload-unauthenticated-RCEExploit, Third Party Advisory
• https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-07Exploit, Third Party Advisory
• https://www.nu11secur1ty.com/2021/09/cve-nu11-07-elearning-v2by-oretnom23-is.htmlExploit, Third Party Advisory
• https://www.nu11secur1ty.com/2021/11/cve-2021-42580.htmlExploit, Third Party Advisory

Published

Nov 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-4257A vulnerability was found in ctrlo lenio. It has been declar…6.1
• CVE-2021-42574An issue was discovered in the Bidirectional Algorithm in th…8.3
• CVE-2021-42575The OWASP Java HTML Sanitizer before 20211018.1 does not pro…9.8
• CVE-2021-42576The bluemonday sanitizer before 1.0.16 for Go, and before 0.…9.8
• CVE-2021-42577An issue was discovered in Softing OPC UA C++ SDK before 5.7…7.5
• CVE-2021-4258A vulnerability was found in whohas. It has been rated as pr…7.5
• CVE-2021-42581Prototype poisoning in function mapObjIndexed in Ramda 0.27.…9.1
• CVE-2021-42583A Broken or Risky Cryptographic Algorithm exists in Max Mazu…7.5
• CVE-2021-42584A Stored Cross Site Scripting (XSS) issue exists in Convos-C…5.4
• CVE-2021-42585A heap buffer overflow was discovered in copy_compressed_byt…8.8
• CVE-2021-42586A heap buffer overflow was discovered in copy_bytes in decod…8.8
• CVE-2021-4259A vulnerability was found in phpRedisAdmin up to 1.16.1. It …9.8