CVE-2021-43990

The affected product is vulnerable to a network-based attack by threat actors supplying a crafted, malicious XML payload designed to trigger an external entity reference call.

• CWE-611

• https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03Patch, Third Party Advisory, US Government Resource
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-109-03Patch, Third Party Advisory, US Government Resource

Published

Apr 20, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43985An unauthenticated remote attacker can access mySCADA myPRO …9.8
• CVE-2021-43986The setup program for the affected product configures its fi…7
• CVE-2021-43987An additional, nondocumented administrative account exists i…9.8
• CVE-2021-43988The affected product is vulnerable to a network-based attack…5.9
• CVE-2021-43989mySCADA myPRO Versions 8.20.0 and prior stores passwords usi…7.5
• CVE-2021-4399The Edwiser Bridge plugin for WordPress is vulnerable to Cro…8.8
• CVE-2021-43991The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerab…5.4
• CVE-2021-43996The Ignition component before 1.16.15, and 2.0.x before 2.0.…9.8
• CVE-2021-43997FreeRTOS versions 10.2.0 through 10.4.5 do not prevent non-k…7.8
• CVE-2021-43998HashiCorp Vault and Vault Enterprise 0.11.0 up to 1.7.5 and …6.5
• CVE-2021-43999Apache Guacamole 1.2.0 and 1.3.0 do not properly validate re…8.8
• CVE-2021-4400The Better Search plugin for WordPress is vulnerable to Cros…4.3