Back to KEVs

CVE-2021-37291

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.

Basic Information

CVE State
PUBLISHED
Reserved Date
July 21, 2021
Published Date
April 11, 2022
Last Updated
August 04, 2024
Vendor
KevinLAB Inc
Product
Building Energy Management System
Description
An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.
Tags
php

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score

Score
0.58% (Percentile: 67.69%) as of 2025-05-31

Exploit Status

Exploited in the Wild
Yes (added 2025-05-03 00:00:00 UTC) Source

References

https://www.zeroscience.mk/en/vulnerabilities/ http://www.kevinlab.com

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-05-03 00:00:00 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel