medium5.4
CVE-2021-37211
The bulletin function of Flygo does not filter special characters while a new announcement is added.
Impact
The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Larvata | Flygo | before 1.91.1 |