CVE-2021-36621
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The...
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
CVE-2021-36621- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
CVE-2021-36621- Updated
- 2026-11-02
EUVDEUVD-2021-23218 No score
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
EUVD-2021-23218- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jpfx-pvpj-qwrq No score
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The...
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
GHSA-jpfx-pvpj-qwrq- Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36621 is a high vulnerability (CVSS 8.1) in Online Covid Vaccination Scheduler System Project Covid Vaccination Scheduler System, published July 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. No source names a fixed version.
References
exploit-db.com/exploits/50109
github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-18-09-2821
packetstormsecurity.com/files/164324/Covid-Vaccination-Scheduler-System-1.0-SQL-Injection-Cross-Site-Scripting.html
nvd.nist.gov/vuln/detail/CVE-2021-36621