CVE-2021-31930

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-319329.8Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. A malicious unauthenticated user can get access to all t CVE-2021-319337.2A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uplo CVE-2021-319346.1OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the CVE-2021-319356.1OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling CVE-2021-319367.4Microsoft Accessibility Insights for Web Information Disclosure Vulnerability CVE-2021-319378.2Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability CVE-2021-319387.3Microsoft VsCode Kubernetes Tools Extension Elevation of Privilege Vulnerability CVE-2021-319397.8Microsoft Excel Remote Code Execution Vulnerability CVE-2021-319407.8Microsoft Office Graphics Remote Code Execution Vulnerability CVE-2021-319417.8Microsoft Office Graphics Remote Code Execution Vulnerability CVE-2021-319427.83D Viewer Remote Code Execution Vulnerability CVE-2021-319437.83D Viewer Remote Code Execution Vulnerability