CVE-2021-36605: XSS
engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36605?
CVE-2021-36605 has a medium severity rating due to its potential for Cross Site Scripting (XSS) attacks.
How do I fix CVE-2021-36605?
To fix CVE-2021-36605, ensure that input in the nickname field is properly sanitized and escapes special characters to prevent XSS.
Which version of Engineercms is affected by CVE-2021-36605?
CVE-2021-36605 affects Engineercms version 1.03.
What is Cross Site Scripting (XSS) in the context of CVE-2021-36605?
In the context of CVE-2021-36605, Cross Site Scripting (XSS) allows attackers to inject malicious JavaScript into the nickname field, which executes in users' browsers.
Is user data at risk due to CVE-2021-36605?
Yes, user data is at risk with CVE-2021-36605 as an attacker could exploit the XSS vulnerability to manipulate user sessions or steal sensitive information.