TI-2021-04010 Aliases CVE-2021-20784 GHSA-vxfp-88g2-6m62

HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the…

LOW 29CWE-644Published 2021-07-14 · Updated 2024-12-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

HTTP header injection vulnerability in Everything version 1.0, 1.1, and 1.2 except the Lite version may allow a remote attacker to inject an arbitrary script or alter the website that uses the product.

Why it matters now

EPSS 0.01118 66th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Voidtools	Everything	all versions of 1.0 (Everything 1.0 series) except the Lite version	—	No fix listed	CNA
Voidtools	Everything	all versions of 1.1 (Everything 1.1 series) except the Lite version	—	No fix listed	CNA
Voidtools	Everything	all versions of 1.2 (Everything 1.2 series) except the Lite version	—	No fix listed	CNA

Everything VendorVoidtools Affected all versions of 1.0 (Everything 1.0 series) except the Lite version Fixed in — No fix listed CNA
Everything VendorVoidtools Affected all versions of 1.1 (Everything 1.1 series) except the Lite version Fixed in — No fix listed CNA
Everything VendorVoidtools Affected all versions of 1.2 (Everything 1.2 series) except the Lite version Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:voidtools:everything::::::::	before 1.1; 1.1 to before 1.2; 1.2 to before 1.3	Vulnerable	Voidtools

cpe:2.3:a:voidtools:everything:*:*:*:*:*:*:*:* Versions before 1.1; 1.1 to before 1.2; 1.2 to before 1.3 Vulnerable ·Voidtools

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2021-20784
2026-10-03 Alias added: GHSA-vxfp-88g2-6m62

References

Advisory 3

Other 1

https://jvn.jp/en/jp/JVN68971465/

TI-2023-12367 Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS). CVSS 3.1MEDIUM 5.5
TI-2020-15048 voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via… CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences