CVE-2021-26634: Maxboard multiple vulnerabilities

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-06-02 · updated 2026-06-17
Weakness: CWE-89

Description

SQL injection and file upload attacks are possible due to insufficient validation of input values in some parameters and variables of files compromising Maxboard, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

Affected products

MaxBoard: before 1.9.6 — fixed in 1.9.6

How to fix

Upgrade to a fixed version: MaxBoard 1.9.6. Check the vendor advisory for mitigations.

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66746
https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66746

Get alerted when CVE-2021-26634 or the next vulnerability affects your stack