High severity8.2NVD Advisory· Published Aug 23, 2021· Updated Jun 17, 2026

CVE-2021-3694

Description

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ledgersmb/Ledgersmb3 versions
cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:ledgersmb:ledgersmb:*:*:*:*:*:*:*:*range: >=1.1.0,<=1.1.12
- (no CPE)
- (no CPE)range: unspecified
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

github.com/ledgersmb/ledgersmb/commit/98fa476d46a4a7e5e9492ed69b4fa190be5547fcnvdPatchThird Party Advisory
huntr.dev/bounties/ef7f4cf7-3a81-4516-b261-f5b6ac21430cnvdThird Party Advisory
ledgersmb.org/cve-2021-3694-cross-site-scriptingnvdVendor Advisory
www.debian.org/security/2021/dsa-4962nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000