CVE-2021-36621
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The...
CVE-2021-36621 is a high vulnerability (CVSS 8.1) in Online Covid Vaccination Scheduler System Project Covid Vaccination Scheduler System, published July 29, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.07%, the 81st percentile. No source names a fixed version.
- Severity
- 8.1 HighCVSS 3.1, NVD
- Exploit chance
- 2.07%EPSS, 81st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
Affected products
What each source reports
NVD Score used
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
CVE-2021-36621- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE ListNo score
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
CVE-2021-36621- Updated
- 2026-11-02
EUVDEUVD-2021-23218No score
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
EUVD-2021-23218- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jpfx-pvpj-qwrqNo score
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The...
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
- Record
GHSA-jpfx-pvpj-qwrq- Weakness
- CWE-89
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
exploit-db.com/exploits/50109
github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-18-09-2821
packetstormsecurity.com/files/164324/Covid-Vaccination-Scheduler-System-1.0-SQL-Injection-Cross-Site-Scripting.html
nvd.nist.gov/vuln/detail/CVE-2021-36621