CVE-2021-1365: Cisco Unified Communications Manager Im And Presence Service

High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Multiple vulnerabilities in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. These vulnerabilities are due to improper validation of user-submitted parameters. An attacker could exploit these vulnerabilities by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain data or modify data that is stored in the underlying database.

Affected products

• Cisco Unified Communications Manager Im And Presence Service: from 10.5, before 11.5\(1\)su9 (fixed in 11.5\(1\)su9); from 12.0, before 12.5\(1\)su4 (fixed in 12.5\(1\)su4)

Published 2021-05-06. Last modified 2026-06-17.