CVE-2021-28132: Lucysecurity Security Awareness

Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days.

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.

Affected products

• Lucysecurity Security Awareness: up to and including 4.7.8

Published 2021-03-11. Last modified 2026-06-17.