Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2021-47925CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting

Medium 6.4

In plain English

A medium-severity cross-site scripting in CMDBuild from Cmdbuild. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 84.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file attachments in the classes endpoint, which execute when other users view the affected records or preview attachments.

Affected products (as reported)

Vendor	Product	Versions
Cmdbuild	CMDBuild	CMDBuild 3.3.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50527 exploit
Official Product Homepage product
Product Reference product
VulnCheck Advisory: CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting third-party-advisory