Vulnerability · Published Dec 9, 2025 · Assigned by VulnCheck
CVE-2021-47723STVS ProVision Cross-Site Request Forgery (Add Admin)
Medium 6.9
In plain English
A medium-severity cross-site request forgery in STVS ProVision from STVS SA. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)0.2%top 90.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| STVS SA | STVS ProVision | 5.9.10 (build 2885-3a8219a) |
Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- ExploitDB-49482 exploit
- STVS SA Homepage product
- Zero Science Lab Disclosure (ZSL-2021-5625) third-party-advisory
- VulnCheck Advisory: STVS ProVision Cross-Site Request Forgery (Add Admin) third-party-advisory