Grand Vice info Co. webopac7 - Arbitrary File Upload
Priority MEDIUM 43CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Grand Vice info Co. webopac7 file upload function fails to filter special characters. While logging in with general user’s permission, remote attackers can upload malicious script and execute arbitrary code to control the system or interrupt services.
Why it matters now
EPSS 0.02427 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grand Vice info | webopac7 | 7.1.20160701; 1.8.20160701 | — | No fix listed | CNA |
- webopac7 VendorGrand Vice info Affected 7.1.20160701; 1.8.20160701 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vice:webopac:1.8.20160701:*:*:*:*:*:*:* | 1.8.20160701 | Vulnerable | Grand Vice info |
| cpe:2.3:a:vice:webopac:7.1.20160701:*:*:*:*:*:*:* | 7.1.20160701 | Vulnerable | Grand Vice info |
- cpe:2.3:a:vice:webopac:1.8.20160701:*:*:*:*:*:*:* Versions 1.8.20160701 Vulnerable ·Grand Vice info
- cpe:2.3:a:vice:webopac:7.1.20160701:*:*:*:*:*:*:* Versions 7.1.20160701 Vulnerable ·Grand Vice info
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42839
- 2026-10-03 Alias added: GHSA-mhvw-gjfc-ccqf
References
More Grand Vice info Webopac vulnerabilities
- TI-2024-10208 Grand Vice info Webopac - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2024-10206 Grand Vice info Webopac - SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-10210 Grand Vice info Webopac7 - SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-10207 Grand Vice info Webopac - Arbitrary File Upload CVSS 3.1HIGH 8.8
- TI-2021-19002 Grand Vice info Co. webopac7 - Reflected XSS CVSS 3.1MEDIUM 6.1
- TI-2024-10209 Grand Vice info Webopac7 - Reflected XSS CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-42839 · CVE Program
- CVE-2021-42839 · NVD
- FIRST EPSS
- GHSA-mhvw-gjfc-ccqf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences