CVE-2021-42580

CRITICAL 9.8CVE-2021-42580 · Published 15/11/2021 · updated 17/06/2026

In short

CVE-2021-42580 is a CRITICAL (CVSS 9.8) vulnerability affecting online learning system (oretnom23).
Chance of exploitation in the next 30 days (EPSS): 10.1%, higher than 95.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
online learning system oretnom23	`= 2.0`	No fix yet

Description

Sourcecodester Online Learning System 2.0 is vunlerable to sql injection authentication bypass in admin login file (/admin/login.php) and authenticated file upload in (Master.php) file , we can craft these two vunlerablities to get unauthenticated remote command execution.

References

packetstormsecurity.com/files/164985/Online-Learning-System-2.0-Remote-Code-Execution.html · Exploit
DjebbarAnon/online-learning-system-v2-sqli-authentication-bypass-file-upload-unauthenticated-RCE · Exploit
nu11secur1ty/CVE-nu11secur1ty · Exploit
nu11secur1ty.com/2021/09/cve-nu11-07-elearning-v2by-oretnom23-is.html · Exploit
nu11secur1ty.com/2021/11/cve-2021-42580.html · Exploit

More vulnerabilities in online learning system

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

online learning system

oretnom23

= 2.0

No fix yet

More vulnerabilities in online learning system

See all →