Vulnerability · Published Jan 15, 2026 · Assigned by VulnCheck
CVE-2021-47801Vianeos OctoPUS 5 - 'login_user' SQLi
High 8.2
In plain English
A high-severity SQL injection in Vianeos OctoPUS from Vianeos. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities).
Severity (CVSS 3.1)8.2High
Exploit odds (30 days)0.4%top 67.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to extract information.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Vianeos | Vianeos OctoPUS | > V5 |
Weakness: CWE-89 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- ExploitDB-50078 exploit
- Vendor Homepage product
- Software Product Page product
- VulnCheck Advisory: Vianeos OctoPUS 5 - 'login_user' SQLi third-party-advisory