Login Request a demo
High severity · published Dec 23, 2021
CVE-2021-44600
The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
The password parameter on Simple Online Mens Salon Management System (MSMS) 1.0 appears to be vulnerable to SQL injection attacks through the password parameter. The predictive tests of this application interacted with that domain, indicating that the injected SQL query was executed. The attacker can retrieve all authentication and information about the users of this system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SO
Simple Online Men's Salon Management System · Oretnom23
1.0 · source: NVD
Affected product
SO
Simple Online Men's Salon Management System
Oretnom23
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-44600
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-44600
Exploit
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/MSMS
More from Simple Online Men's Salon Management System
9.8
CVE-2024-5069
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Mens Salon Management System 1.0
9.8
CVE-2023-3987
A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0
4.8
CVE-2023-3986
A vulnerability was found in SourceCodester Simple Online Mens Salon Management System 1.0 and classified as problematic
2.7
CVE-2026-26886
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /admin/services/manage_service.php
2.7
CVE-2026-26883
Sourcecodester Online Men's Salon Management System v1.0 is vulnerable to SQL Injection in /msms/classes/Master.php?f=delete_appointment