onyx --cves cve-2021-21705

CVE-2021-21705

MEDPOCPHP

score: <0.1
cvss: 4.3
epss: 2.1%
published: 2021-10-04
kev added: —
first seen: 2026-10-21

PHP < 7.3.29, < 7.4.21, < 8.0.8 contains a URL validation issue caused by accepting URLs with invalid password fields in filter_var() with FILTER_VALIDATE_URL, letting attackers potentially cause incorrect URL parsing, exploit requires attacker to supply malicious URL.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2021-10-04 Published
2026-10-21 Tracked by Onyx
2026-10-21 Public PoC

Exploit availability

Public PoC flagged by vulnx; no direct exploit link among the citations.

Weaknesses

CWE-20

References 4

https://bugs.php.net/bug.php?id=81122
https://www.oracle.com/security-alerts/cpujan2022.html
https://security.gentoo.org/glsa/202209-20
https://security.netapp.com/advisory/ntap-20211029-0006/