CVE-2021-26596

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-265976.5An issue was discovered in Nokia NetAct 18A. A remote user, authenticated to the NOKIA NetAct Web Page, can visit the Site Configuration Too CVE-2021-265985.3ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by d CVE-2021-265999.8ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.CVE-2021-266009.8ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).CVE-2021-266018.1ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.CVE-2021-266037.8A heap overflow issue was found in ARK library of bandisoft Co., Ltd when the Ark_DigPathA function parsed a file path. This vulnerability i CVE-2021-266059.8An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred w CVE-2021-266069.8A vulnerability in PKI Security Solution of Dream Security could allow arbitrary command execution. This vulnerability is due to insufficien CVE-2021-266079.8An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected sys CVE-2021-266089.8An arbitrary file download and execution vulnerability was found in the HShell.dll of handysoft Co., Ltd groupware ActiveX module. This issu CVE-2021-266097.5A vulnerability was found in Mangboard(WordPress plugin). A SQL-Injection vulnerability was found in order_type parameter. The order_type pa CVE-2021-266108.8The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulne