Skip to content
Fencer Vulns
high 7.5

CVE-2021-46354 in the critical feed json

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the pa…

published 2022-02-09 4 y ago modified 2026-07-09 4 mo ago also EUVD-2021-33042

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
12.9%
EPSS 12.9% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. The ability to send requests to other systems can allow the vulnerable server to filtrate the real IP of the web server or increase the attack surface.

Timeline

  1. Published
  2. First public exploit (EDB-50771)

Exploit prediction

12.89% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-50771 Thinfinity VirtualUI 2.5.26.2 - Information Disclosure webapps, 2022-02-21

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-668 Exposure of Resource to Wrong Sphere

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.