CVE-2021-3694: Debian Linux

Critical severity, CVSS 9.6. EPSS: 2.5% chance of exploitation in the next 30 days.

LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Affected products

• Debian Debian Linux: version 10.0 only; version 11.0 only
• Ledgersmb Ledgersmb: from 1.1.0, up to and including 1.1.12; from 1.2.0, up to and including 1.2.26; from 1.3.0, up to and including 1.3.47; from 1.4.0, up to and including 1.4.42; from 1.5.0, up to and including 1.5.30; from 1.6.0, up to and including 1.6.33; …

Published 2021-08-23. Last modified 2026-06-17.