CVE-2021-33483

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 7, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-334847.5An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. An attacker can download a copy of the installer, decompile i CVE-2021-334859.8CODESYS Control Runtime system before 3.5.17.10 has a Heap-based Buffer Overflow.CVE-2021-334867.5All versions of the CODESYS V3 Runtime Toolkit for VxWorks from version V3.5.8.0 and before version V3.5.17.10 have Improper Handling of Exc CVE-2021-334886.1chat in OX App Suite 7.10.5 has Improper Input Validation. A user can be redirected to a rogue OX Chat server via a development-related hook CVE-2021-334896.1OX App Suite through 7.10.5 allows XSS via JavaScript code in a shared XCF file.CVE-2021-33493.3GNOME Evolution through 3.38.3 produces a "Valid signature" message for an unknown identifier on a previously trusted key because Evolution CVE-2021-334906.1OX App Suite through 7.10.5 allows XSS via a crafted snippet in a shared mail signature.CVE-2021-334916.5OX App Suite through 7.10.5 allows Directory Traversal via ../ in an OOXML or ODF ZIP archive, because of the mishandling of relative paths CVE-2021-334926.1OX App Suite 7.10.5 allows XSS via an OX Chat room name.CVE-2021-334936.0The middleware component in OX App Suite through 7.10.5 allows Code Injection via Java classes in a YAML format.CVE-2021-334946.1OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.CVE-2021-334956.1OX App Suite 7.10.5 allows XSS via an OX Chat system message.