CRITICAL🇵🇱 Wersja polska

CVE-2021-42777

CVSS 9.8v3.1pub. 2022-10-29upd. 2025-05-07

Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0, when Compilation Mode is used, allows an attacker to execute arbitrary C# code on any machine that renders a report, including the application server or a user's local machine, as demonstrated by System.Diagnostics.Process.Start.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Stimulsoft Reports

    APP
    Stimulsoft
    2013.1.1600.0
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-15865CRITICAL9.8PL ✓same product

RCE w Stimulsoft Reports — wykonanie kodu C# przez plik raportu XML

CVE-2024-24398CRITICAL9.8PL ✓same vendor

Path Traversal umożliwiający RCE w Stimulsoft Dashboard.JS

CVE-2023-25261CRITICAL9.8PL ✓same vendor

RCE w Stimulsoft Designer i Viewer — brak ograniczeń dostępu do systemu plików

CVE-2023-25262HIGH7.5same vendor

Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe R...

CVE-2023-25260HIGH7.5same vendor

Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.