CVE-2021-30137

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XML unmarshalling. The application allows users to send JSON or XML data to the server. It was possible to inject malicious XML data through several access points.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-611

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-301397.5In Alpine Linux apk-tools before 2.12.5, the tarball parser allows a buffer overflow and crash.CVE-2021-30146.1In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.CVE-2021-301405.4LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has CVE-2021-301417.5Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an CVE-2021-301444.3The Dashboard plugin through 1.0.2 for GLPI allows remote low-privileged users to bypass access control on viewing information about the las CVE-2021-301457.8A format string vulnerability in mpv through 0.33.0 allows user-assisted remote attackers to achieve code execution via a crafted m3u playli CVE-2021-301465.4Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."CVE-2021-301478.8DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such as adding new manager accounts via admin.php.CVE-2021-301499.8Composr 10.0.36 allows upload and execution of PHP files.CVE-2021-301506.1Composr 10.0.36 allows XSS in an XML script.CVE-2021-301516.1Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.CVE-2021-301524.3An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a pag