CVE-2021-37504

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.jsThird Party Advisory
http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.jsThird Party Advisory
http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.cssThird Party Advisory
https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469Third Party Advisory
https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.jsThird Party Advisory
http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.jsThird Party Advisory
http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.jsThird Party Advisory
http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.cssThird Party Advisory
https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469Third Party Advisory
https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.jsThird Party Advisory

Timeline

Published: Feb 25, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-37519.8libmobi is vulnerable to Out-of-bounds Write CVE-2021-375177.5An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.0,in the forgot-password function becuase the appli CVE-2021-375186.1Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via o CVE-2021-375195.5Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.CVE-2021-37527.1A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simulta CVE-2021-375229.8SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db CVE-2021-375246.1Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via CVE-2021-375295.5A double-free vulnerability exists in fig2dev through 3.28a is affected by: via the free_stream function in readpics.c, which could cause a CVE-2021-37534.7A race problem was seen in the vt_k_ioctl in drivers/tty/vt/vt_ioctl.c in the Linux kernel, which may cause an out of bounds read in vt as t CVE-2021-375305.5A denial of service vulnerabiity exists in fig2dev through 3.28a due to a segfault in the open_stream function in readpics.c.CVE-2021-375318.8SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a no CVE-2021-375324.3SAP Business One version - 10, due to improper input validation, allows an authenticated User to gain access to directory and view the conte