CVE-2021-47801

8.8 highEPSS 0.4%

High (8.8). EPSS 0.4% chance of exploitation in the next 30 days.

Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to extract information.

Severity

CVSS 4.0

8.8 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.2 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2026-01-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

http://www.vianeos.com/en/home-vianeos/
https://vianeos.com/en/products/octopus
https://www.exploit-db.com/exploits/50078
https://www.vulncheck.com/advisories/vianeos-octopus-loginuser-sqli

Check your stack JSON