ACTIVELY EXPLOITED
CVE-2021-42258: BQE BillQuick Web Suite SQL Injection Vulnerability
| Vendor | BQE |
|---|---|
| Product | BillQuick Web Suite |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Nov 2021 |
| CISA federal deadline | 17 Nov 2021 |
| Ransomware use | Known |
| Weakness (CWE) | CWE-89 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
BQE BillQuick Web Suite contains an SQL injection vulnerability when accessing the username parameter that may allow for unauthenticated, remote code execution.
SOURCES
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.