CVE-2021-3811

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
pi-hole	pi-hole/adminlte	>= unspecified, < 5.6

References

https://github.com/pi-hole/adminlte/commit/f526716de7bb0fd382a64bcbbb33915c926f94bbPatch, Third Party Advisory
https://huntr.dev/bounties/fa38c61f-4043-4872-bc85-7fe5ae5cc2e8Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/pi-hole/adminlte/commit/f526716de7bb0fd382a64bcbbb33915c926f94bbPatch, Third Party Advisory
https://huntr.dev/bounties/fa38c61f-4043-4872-bc85-7fe5ae5cc2e8Exploit, Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Sep 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-381107.8Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An CVE-2021-381118.8The DEF CON 27 badge allows remote attackers to exploit a buffer overflow by sending an oversized packet via the NFMI (Near Field Magnetic I CVE-2021-381128.8In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows, argument injection in the workspaces:// URI handler can lead to remote CVE-2021-381135.4In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the CVE-2021-381145.5libavcodec/dnxhddec.c in FFmpeg 4.4 does not check the return value of the init_vlc function, a similar issue to CVE-2013-0868.CVE-2021-381156.5read_header_tga in gd_tga.c in the GD Graphics Library (aka LibGD) through 2.3.2 allows remote attackers to cause a denial of service (out-o CVE-2021-381168.8Possible Elevation of Privilege Vulnerability in iManager has been discovered in OpenText™ iManager. This impacts all versions before 3.2.5 CVE-2021-381179.8Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-381187.8Possible improper input validation Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-381196.1Possible Reflected Cross-Site Scripting (XSS) Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.CVE-2021-38126.1adminlte is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-381207.2A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup