CVE-2021-28132

9.8 criticalEPSS 3.2%

Critical (9.8) in lucysecurity security awareness. EPSS 3.2% chance of exploitation in the next 30 days.

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2021-03-11
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

lucysecurity:security_awareness

References

https://abuyv.com/cve/lucy-file-upload-RCE
https://abuyv.com/cve/lucy-file-upload-RCE

Check your stack JSON