CVE-2021-25268

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 5, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-252694.4A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in CVE-2021-252706.7A local attacker could execute arbitrary code with administrator privileges in HitmanPro.Alert before version Build 901.CVE-2021-252716.0A local attacker could read or write arbitrary files with administrator privileges in HitmanPro before version Build 318.CVE-2021-252734.8Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.CVE-2021-252749.8The Collector Service in SolarWinds Orion Platform before 2020.2.4 uses MSMQ (Microsoft Message Queue) and doesn't set permissions on its pr CVE-2021-252757.8SolarWinds Orion Platform before 2020.2.4, as used by various SolarWinds products, installs and uses a SQL Server backend, and stores databa CVE-2021-252767.1In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a directory containing user profile files (that include users' password hashes) that i CVE-2021-252776.1FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.CVE-2021-252784.8FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.CVE-2021-252819.8An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus,CVE-2021-252829.1An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory travers CVE-2021-252839.8An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection