CVE-2021-3860: JFrog Artifactory

High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days.

JFrog Artifactory before 7.25.4 (Enterprise+ deployments only), is vulnerable to Blind SQL Injection by a low privileged authenticated user due to incomplete validation when performing an SQL query.

Affected products

• JFrog Artifactory: before 6.23.30 (fixed in 6.23.30); from 7.11.0, before 7.11.8 (fixed in 7.11.8); from 7.12.0, before 7.12.10 (fixed in 7.12.10); from 7.17.0, before 7.17.14 (fixed in 7.17.14); from 7.18.0, before 7.18.11 (fixed in 7.18.11); from 7.19.0, before 7.19.12 (fixed in 7.19.12); …

Published 2021-12-20. Last modified 2026-06-17.