CVE-2021-3355

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored-self XSS exists in LightCMS v1.3.4, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69bExploit, Third Party Advisory
https://github.com/eddy8/LightCMS/issues/18Exploit, Issue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/49598Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161562/LightCMS-1.3.4-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://gist.github.com/Peithon/1c628ded0c4fc96c6331c3cce1d0c69bExploit, Third Party Advisory
https://github.com/eddy8/LightCMS/issues/18Exploit, Issue Tracking, Third Party Advisory
https://www.exploit-db.com/exploits/49598Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Feb 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-335507.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to CVE-2021-335517.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to CVE-2021-335527.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to CVE-2021-335537.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to CVE-2021-335547.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to CVE-2021-335557.5In PEPPERL+FUCHS WirelessHART-Gateway <= 3.0.7 the filename parameter is vulnerable to unauthenticated path traversal attacks, enabling read CVE-2021-335576.1An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows CVE-2021-335587.5Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, l CVE-2021-335607.5Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel att CVE-2021-335614.8A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML v CVE-2021-335624.8A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTM CVE-2021-335637.5Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. T