CVE-2021-39392

9.8 criticalEPSS 2.3%

Critical (9.8) in mylittletools mylittlebackup. EPSS 2.3% chance of exploitation in the next 30 days.

The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2021-09-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

mylittletools:mylittlebackup

References

http://www.mylittlebackup.com/mlb/zip/mlb_1.7.zip
https://gist.github.com/omriinbar/65827626e63f15e3e50557e2d9d61281
http://www.mylittlebackup.com/mlb/zip/mlb_1.7.zip
https://gist.github.com/omriinbar/65827626e63f15e3e50557e2d9d61281

Check your stack JSON