CVE-2021-32092

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-320936.5The ConfigFileAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to read arbitrary files vi CVE-2021-320948.8U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.CVE-2021-320958.1U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.CVE-2021-320968.8The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary R CVE-2021-320989.8Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.CVE-2021-320999.8A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his u CVE-2021-32109.6components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands wh CVE-2021-321006.5A remote file inclusion vulnerability exists in Artica Pandora FMS 742, exploitable by the lowest privileged user.CVE-2021-321018.2The Patient Portal of OpenEMR 5.0.2.1 is affected by a incorrect access control system in portal/patient/_machine_config.php. To exploit the CVE-2021-321028.8A SQL injection vulnerability exists (with user privileges) in library/custom_template/ajax_code.php in OpenEMR 5.0.2.1.CVE-2021-321034.8A Stored XSS vulnerability in interface/usergroup/usergroup_admin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject CVE-2021-321048.8A SQL injection vulnerability exists (with user privileges) in interface/forms/eye_mag/save.php in OpenEMR 5.0.2.1.