CVE-2021-37214: Larvata Flygo

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator privilege and execute arbitrary command.

Affected products

• Larvata Flygo: before 1.91.1 (fixed in 1.91.1)

Published 2021-08-09. Last modified 2026-06-17.