Vulnerability · Published Mar 16, 2022 · Assigned by mitre
CVE-2021-45822
Medium 6.1
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.1%top 35.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/sendChatData.php does not properly validate the value of the "n" (POST) parameter. Through this vulnerability, an attacker is capable to execute malicious JavaScript code.
Affected products (as reported)
References
- https://github.com/btiteam/xbtit-3.1 x_refsource_MISC
- https://emaragkos.gr/infosec-adventures/xbtit-3-1-xss-stored-amp-reflected/ x_refsource_MISC
- https://github.com/btiteam/xbtit-3.1/issues/7 x_refsource_MISC