Vulnerability · Published Jul 26, 2021 · Assigned by mitre

CVE-2021-37393

Medium 5.4

In plain English

A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.5%top 55.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ralap-z/RPCMS/ x_refsource_MISC
https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f x_refsource_MISC