medium6.1Public exploit code
CVE-2021-31674
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cyclos 4.14.7 - DOM Based Cross-Site Scripting (XSS)2022-05-11 · webapps · multiple
Impact
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cyclos | Cyclos | from 4.0.0 through 4.14.7 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/167040/Cyclos-4.14.7-Cross-Site-Scripting.html
- https://tf1t.gitbook.io/mycve/cylos/cyclos-4.14.7-dom-based-cross-site-scripting-in-undefined-enum-cve-2021-31674
- https://www.exploit-db.com/exploits/50908
- https://tf1t.gitbook.io/mycve/cylos/cyclos-4.14.7-dom-based-cross-site-scripting-in-undefined-enum-cve-2021-31674
- https://www.exploit-db.com/exploits/50908