CVE-2021-28157: Devolutions Server

High severity, CVSS 7.2. EPSS: 0.8% chance of exploitation in the next 30 days.

An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete.

Affected products

• Devolutions Devolutions Server: before 2020.3.18 (fixed in 2020.3.18); before 2021.1 (fixed in 2021.1)

Published 2021-04-14. Last modified 2026-06-17.