CVE-2021-21418

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 31, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-214195.3Eventlet is a concurrent networking library for Python. A websocket peer may exhaust memory on Eventlet side by sending very large websocketCVE-2021-21426.1Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). The supported version that is affectedCVE-2021-214207.8vscode-stripe is an extension for Visual Studio Code. A vulnerability in Stripe for Visual Studio Code extension exists when it loads an untCVE-2021-214216.5node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user wCVE-2021-214226.1mongo-express is a web-based MongoDB admin interface, written with Node.js and express. 1: As mentioned in this issue: https://github.com/moCVE-2021-214238.1`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GiCVE-2021-214245.3Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The ability to enumerate users was possiblCVE-2021-214259.8Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlieCVE-2021-214269.8Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and pCVE-2021-214277.2Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 andCVE-2021-214287.0Openapi generator is a java tool which allows generation of API client libraries (SDK generation), server stubs, documentation and configuraCVE-2021-214293.3OpenAPI Generator allows generation of API client libraries, server stubs, documentation and configuration automatically given an OpenAPI Sp
CVE-2021-21418: Medium severity, CVSS 5.4 | Vulnix