CVE-2021-3262

TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body parameters from end users without sanitizing using server-side logic. It was possible to inject custom SQL commands into the "Student Busing Information" search queries.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.02% chance of exploitation in the next 30 days, 61th percentile

Published

2023-08-29

Updated

2026-07-09

Proof-of-concept exploits (2)

• https://susos.co/blog/f/cve-disclosureuncovered-sql-injection-in-tripspark-veo-transport
• l0lsec/CVE-2021-3262

References

• CVE Record
• NVD entry

Related

• CVE-2026-0651
• CVE-2026-0652
• CVE-2026-0653
• CVE-2021-32618
• CVE-2021-32633
• CVE-2021-32612