CVE-2021-36739

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Portals	org.apache.portals.pluto.archetype:mvcbean-jsp-portlet-archetype 3.1.0

References

https://lists.apache.org/thread/m5j87nn1lmvzp8b9lmh7gqq68g5lnb7pVendor Advisory
https://lists.apache.org/thread/m5j87nn1lmvzp8b9lmh7gqq68g5lnb7pVendor Advisory

Timeline

Published: Jan 6, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-36747.8A flaw was found in rizin. The create_section_from_phdr function allocates space for ELF section data by processing the headers. Crafted val CVE-2021-367406.5Varnish Cache, with HTTP/2 enabled, allows request smuggling and VCL authorization bypass via a large Content-Length header for a POST reque CVE-2021-367418.8An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 1 CVE-2021-367427.8A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.CVE-2021-367447.8Trend Micro Security (Consumer) 2021 and 2020 are vulnerable to a directory junction vulnerability which could allow an attacker to exploit CVE-2021-367459.8A vulnerability in Trend Micro ServerProtect for Storage 6.0, ServerProtect for EMC Celerra 5.8, ServerProtect for Network Appliance Filers CVE-2021-367465.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.CVE-2021-367475.4Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.CVE-2021-367487.5A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote a CVE-2021-367496.5In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows aut CVE-2021-36757.1Improper Input Validation vulnerability in synaTEE.signed.dll of Synaptics Fingerprint Driver allows a local authorized attacker to overwrit CVE-2021-367508.1ENC DataVault before 7.2 and VaultAPI v67 mishandle key derivation, making it easier for attackers to determine the passwords of all DataVau