CVE-2021-22676

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	WebAccess/SCADA	WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-217-04Third Party Advisory, US Government Resource

Timeline

Published: Aug 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226777.8An integer overflow exists in the APIs of the host MCU while trying to connect to a WIFI network may lead to issues such as a denial-of-serv CVE-2021-226787.8Cscape (All versions prior to 9.90 SP4) lacks proper validation of user-supplied data when parsing project files. This could lead to memory CVE-2021-226799.8The affected product is vulnerable to an integer overflow while processing HTTP headers, which may allow an attacker to remotely execute cod CVE-2021-22688.1Vulnerability in the Oracle Quoting product of Oracle E-Business Suite (component: Courseware). Supported versions that are affected are 12.CVE-2021-226809.8NXP MQX Versions 5.1 and prior are vulnerable to integer overflow in mem_alloc, _lwmem_alloc and _partition functions. This unverified memor CVE-2021-226819.8Rockwell Automation Studio 5000 Logix Designer Versions 21 and later, and RSLogix 5000 Versions 16 through 20 use a key to verify Logix cont CVE-2021-226827.8Cscape (All versions prior to 9.90 SP4) is configured by default to be installed for all users, which allows full permissions, including rea CVE-2021-226837.8Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an out-of-bounds write while processing project files, allowing an attacker to cr CVE-2021-226847.5Tizen RT RTOS version 3.0.GBB is vulnerable to integer wrap-around in functions_calloc and mm_zalloc. This improper memory assignment can le CVE-2021-226857.5An attacker may be able to use minify route with a relative path to view any file on the Cassia Networks Access Controller prior to 2.0.1.CVE-2021-22698.1Vulnerability in the Oracle Advanced Pricing product of Oracle E-Business Suite (component: Price Book). The supported version that is affec CVE-2021-226967.5CXF supports (via JwtRequestCodeFilter) passing OAuth 2 parameters via a JWT token as opposed to query parameters (see: The OAuth 2.0 Author