CVE-2021-27693

CRITICAL

Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS1.1%
Percentile64th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-918: Server-Side Request Forgery (SSRF)

Attacker causes the server to make HTTP requests to attacker-chosen destinations, potentially reaching internal services.

Related Attack Patterns (CAPEC)
CAPEC-664 Server Side Request Forgery
via CWE-918

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical Server-side Request Forgery (SSRF) vulnerability exists in PublicCMS versions prior to 4.0.202011.b, specifically in the /publiccms/admin/ueditor endpoint when the action is catchimage. This vulnerability could allow an attacker to make the server initiate requests to arbitrary URLs, potentially leading to unauthorized data access or other malicious activities.

BSID: BS-2022-GLOBAL-268472-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-27693?
A critical Server-side Request Forgery (SSRF) vulnerability exists in PublicCMS versions prior to 4.0.202011.b, specifically in the /publiccms/admin/ueditor endpoint when the action is catchimage. This vulnerability could allow an attacker to make the server initiate requests to arbitrary URLs, potentially leading to unauthorized data access or other malicious activities.
What is the CVSS score for CVE-2021-27693?
CVE-2021-27693 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.1%.
Is CVE-2021-27693 actively exploited?
No confirmed active exploitation of CVE-2021-27693 as of 2026-05-30.
How do I remediate CVE-2021-27693?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-27693?
CVE-2021-27693 affects Publiccms Publiccms.
Vulnerability Details
CVE IDCVE-2021-27693
BSIDBS-2022-GLOBAL-268472-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2022-09-02
Last Modified2024-11-21
ICS Relevance15%
Weakness (CWE)
Server-Side Request Forgery (SSRF)
SourceNVD
Official Description

Server-side Request Forgery (SSRF) vulnerability in PublicCMS before 4.0.202011.b via /publiccms/admin/ueditor when the action is catchimage.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability is exploited by sending a specially crafted request to the /publiccms/admin/ueditor endpoint with the action parameter set to catchimage. This request can be manipulated to make the server send HTTP requests to any URL specified by the attacker, which could be used to access internal network resources or perform other malicious actions.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Publiccms Publiccms < 4.0.202011.b
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1504 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash49e82242326828ac351ba18c28c1177aa5cd76fdc5540bf3ba7549f3ea17dbe87ca948c007794f7e87d2d96d0fbbf0a37dd401a432cb9dc691ae45b4a4536ac4
Related CVEs affecting Publiccms
CVE-2020-20914 9.8 SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote... CVE-2022-23389 9.8 PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulner... CVE-2018-12914 9.8 A remote code execution issue was discovered in PublicCMS V4.0.20180210. An a... CVE-2021-40881 9.8 An issue in the BAT file parameters of PublicCMS v4.0 allows attackers to exe... CVE-2020-20915 9.8 SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker...
View all Publiccms CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →