SQL Injection in tribalsystems/zenario

CRITICAL 9.1CVE-2021-26830 · GHSA-w4f3-7f7c-x652 · Published 16/04/2021 · updated 17/06/2026

In short

CVE-2021-26830 is a CRITICAL (CVSS 9.1) vulnerability affecting tribalsystems/zenario, zenario (tribalsystems).
Chance of exploitation in the next 30 days (EPSS): 4.6%, higher than 91.6% of all vulnerabilities.
Fix: update to 8.8.53370 or later.

Package	Affected versions	Patched versions
tribalsystems/zenario Packagist	`< 8.8.53370`	`8.8.53370`
zenario tribalsystems	`= 8.8.52729`	No fix yet

Description

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the ID input field of ajax.php in the Pugin library - delete module.

NVD description

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.

References

nvd.nist.gov/vuln/detail/CVE-2021-26830 · ADVISORY
TribalSystems/Zenario commit 2c82a4d · WEB
edhunter484.medium.com/blind-sql-injection-on-zenario-cms-b58b6820c32d · WEB
TribalSystems/Zenario release 8.8.53370 · WEB
exploit-db.com/exploits/49642 · WEB

More vulnerabilities in tribalsystems/zenario

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

tribalsystems/zenario

Packagist

< 8.8.53370

8.8.53370

zenario

tribalsystems

= 8.8.52729

No fix yet

Description

NVD description

More vulnerabilities in tribalsystems/zenario

See all →