CVE-2021-37291

CriticalCVSS 9.8

Published: 11/04/2022(UTC)Updated: 05/07/2026(UTC)Translated: 06/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

8.15%

94th percentile - higher than 94% of all known CVEs

Summary

SQL Injection vulnerability in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0. An attacker can inject malicious SQL queries via the input_id POST parameter in index.php.

Risk Assessment

Risk includes unauthorized database access, sensitive data leakage, and potential takeover of the building energy management system.

Recommendation

Immediately update to the latest version or apply a security patch. In the meantime, validate and sanitize all input data, especially the input_id parameter.

Original NVD description (English source)

An SQL Injection vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 ivia the input_id POST parameter in index.php.