CVE-2021-38574: 
Foxit PDF Reader vulnerability analysis and mitigation

An SQL injection vulnerability was discovered in Foxit Reader and PhantomPDF versions before 10.1.4. The vulnerability, identified as CVE-2021-38574, allows attackers to perform SQL injection attacks via crafted data appended to the end of a string. This security flaw was disclosed on August 11, 2021 (NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 9.8 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a Base Score of 7.5 HIGH with the vector (AV:N/AC:L/Au:N/C:P/I:P/A:P). The vulnerability is classified as CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (NVD).

The SQL injection vulnerability could allow attackers to execute unauthorized SQL commands on the affected database, potentially leading to unauthorized access, data manipulation, or data theft. Given the CRITICAL CVSS score of 9.8, this vulnerability represents a severe risk to system security and data integrity (NVD).

Users are advised to upgrade to Foxit Reader and PhantomPDF version 10.1.4 or later to address this vulnerability. The fix has been implemented in these versions to prevent SQL injection attacks via crafted string data (Vendor Advisory).