CVE-2021-35956

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/163343/AKCP-sensorProbe-SPX476-Cross-Site-Scripting.htmlExploit, Third Party Advisory
http://www.akcp.in.th/downloads/Firmwares/SP480-20210624.zipProduct, Vendor Advisory
https://tbutler.org/2021/06/28/cve-2021-35956Exploit, Third Party Advisory
https://www.akcp.com/support-center/customer-login/sensor-probe-firmware-changelog/Permissions Required, Vendor Advisory
http://packetstormsecurity.com/files/163343/AKCP-sensorProbe-SPX476-Cross-Site-Scripting.htmlExploit, Third Party Advisory
http://www.akcp.in.th/downloads/Firmwares/SP480-20210624.zipProduct, Vendor Advisory
https://tbutler.org/2021/06/28/cve-2021-35956Exploit, Third Party Advisory
https://www.akcp.com/support-center/customer-login/sensor-probe-firmware-changelog/Permissions Required, Vendor Advisory

Timeline

Published: Jun 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-359576.7Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can re CVE-2021-359589.1TensorFlow through 2.5.0 allows attackers to overwrite arbitrary files via a crafted archive when tf.keras.utils.get_file is used with extra CVE-2021-359595.4In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT t CVE-2021-35966.5A NULL pointer dereference flaw was found in ImageMagick in versions prior to 7.0.10-31 in ReadSVGImage() in coders/svg.c. This issue is due CVE-2021-359619.8Dr. ID Door Access Control and Personnel Attendance Management system uses the hard-code admin default credentials that allows remote attack CVE-2021-359627.5Specific page parameters in Dr. ID Door Access Control and Personnel Attendance Management system does not filter special characters. Remote CVE-2021-359639.8The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remote unauthe CVE-2021-359649.8The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execu CVE-2021-359659.8The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the web CVE-2021-359666.1The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redi CVE-2021-359675.3The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the s CVE-2021-359684.3The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers ca