CVE-2021-37393: XSS
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-37393?
CVE-2021-37393 is a vulnerability in RPCMS v1.8 and below that allows attackers to inject XSS payloads into the "nickname" variable, leading to stored XSS.
How severe is CVE-2021-37393?
CVE-2021-37393 has a severity keyword of medium with a CVSS score of 5.4.
How can I exploit CVE-2021-37393?
Attackers can exploit CVE-2021-37393 by using the "update password" function to inject XSS payloads into the nickname variable.
What software versions are affected by CVE-2021-37393?
RPCMS v1.8 and below are affected by CVE-2021-37393.
How can I fix CVE-2021-37393?
To fix CVE-2021-37393, users should properly sanitize the nickname variable before displaying it on the page.