CVE-2021-28022

HIGH 7.5CVE-2021-28022 · Published 08/11/2021 · updated 17/06/2026

In short

CVE-2021-28022 is a HIGH (CVSS 7.5) vulnerability affecting servicetonic (servicetonic).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.1% of all vulnerabilities.
Fix: update to 9.0.035937 or later.

Package	Affected versions	Patched versions
servicetonic servicetonic	`< 9.0.035937`	`9.0.035937`

Description

Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries.

References

servicetonic.com · Product
srlabs.de/bites/chaining-three-zero-day-exploits-in-itsm-software-servicetonic-for-remote-code-execution · Exploit

More vulnerabilities in servicetonic

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free