Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Loading CVE intelligence

Loading vulnerability catalog

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

Tool Directory

CVE-2021-39165

HighPublished

Unauthenticated SQL Injection

Published: Aug 26, 2021
Updated: Aug 4, 2024
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

8.1/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS probability estimate

9.8%

Low · next 30 days

Percentile: 95.4%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Cachet is an open source status page. With Cachet prior to and including 2.3.18, there is a SQL injection which is in the `SearchableTrait#scopeSearch()`. Attackers without authentication can utilize this vulnerability to exfiltrate sensitive data from the database such as administrator's password and session. The original repository of Cachet <https://github.com/CachetHQ/Cachet> is not active, the stable version 2.3.18 and it's developing 2.4 branch is affected.

Sources

CVE-2021-39165PoC
Python3 POC for CVE-2021-39165 in CachetHQ
CVE-2021-39165Exploit
Github repository which contains a functional exploit for CVE-2021-39165

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.