CVE-2021-3693: Debian Linux

Critical severity, CVSS 9.6. EPSS: 3.2% chance of exploitation in the next 30 days.

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Ledgersmb Ledgersmb: from 1.5.0, up to and including 1.5.30; from 1.6.0, up to and including 1.6.33; from 1.7.0, up to and including 1.7.32; from 1.8.0, up to and including 1.8.17

Published 2021-08-23. Last modified 2026-06-17.