CVE-2021-3355

EPSS 7.3%

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.htmlunverified cve_referencewww.exploit-db.com/exploits/49598unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.html https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69b https://github.com/eddy8/LightCMS/issues/18 https://www.exploit-db.com/exploits/49598