CVE-2021-42115: Businessdnasolutions Topease

Critical severity, CVSS 9.1. EPSS: 1.3% chance of exploitation in the next 30 days.

Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie UID.

Affected products

• Businessdnasolutions Topease: up to and including 7.1.27

Published 2021-11-30. Last modified 2026-06-17.