CVE-2021-32852mediumCWE-79

CVE-2021-32852: medium-severity vulnerability in countly-server

countly-server vulnerable to Cross-site Scripting

Published · Updated

Follow this CVE+ Monitor countly-server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.9%
Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected products
Countly · countly-server
Related CVEs — countly-server

In the same product, most dangerous first.

CVE-2022-29174HIGHPredictable password reset token may lead to account takeover in countly-serverEPSS 1.5%CVE-2026-42270HIGHcountly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream ExceptionEPSS 0.5%CVE-2026-41582HIGHcountly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal FilesEPSS 0.5%CVE-2026-42269HIGHcountly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory DeletionEPSS 0.5%CVE-2026-44977CRITICALcountly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session contextEPSS 0.4%CVE-2026-87803HIGHCVE-2026-87803EPSS 0.3%