CVE-2021-32772

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Poddycast is a podcast app made with Electron. Prior to version 0.8.1, an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed, which allows the injection of HTML and JS code (cross-site scripting). Being an application made in electron, cross-site scripting can be scaled to remote code execution, making it possible to execute commands on the machine where the application is running. The vulnerability is patched in Poddycast version 0.8.1.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327737.5Racket is a general-purpose programming language and an ecosystem for language-oriented programming. In versions prior to 8.2, code evaluate CVE-2021-327745.4DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no pr CVE-2021-327756.5Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, a non admin user can get access to many class/field valu CVE-2021-327768.8Combodo iTop is a web based IT Service Management tool. In versions prior to 2.7.4, CSRF tokens can be reused by a malicious user, as on Win CVE-2021-327778.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions when e CVE-2021-327787.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy’CVE-2021-327798.3Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions envoy CVE-2021-32789.8Local Service Search Engine Management System 1.0 has a vulnerability through authentication bypass using SQL injection . Using this vulnera CVE-2021-327807.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions Envoy CVE-2021-327817.5Envoy is an open source L7 proxy and communication bus designed for large modern service oriented architectures. In affected versions after CVE-2021-327825.4Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application CVE-2021-327838.5Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service