CVE-2021-40238

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-402399.8A Buffer Overflow vulnerability exists in the latest version of Miniftpd in the do_retr function in ftpproto.c CVE-2021-40246.5A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spa CVE-2021-402419.8xfig 3.2.7 is vulnerable to Buffer Overflow.CVE-2021-402479.8SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL c CVE-2021-40264.3bookstack is vulnerable to Improper Access Control CVE-2021-402606.1Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit.CVE-2021-402616.1Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester CASAP Automated Enrollment System 1.0 via the (1) user_username CVE-2021-402626.5A stack exhaustion issue was discovered in FreeImage before 1.18.0 via the Validate function in PluginRAW.cpp.CVE-2021-402638.8A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad function in PluginTIFF.cpp.CVE-2021-402646.5NULL pointer dereference vulnerability in FreeImage before 1.18.0 via the FreeImage_CloneTag function inFreeImageTag.cpp.CVE-2021-402658.8A heap overflow bug exists FreeImage before 1.18.0 via ofLoad function in PluginJPEG.cpp.CVE-2021-402666.5FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is vulnerabile to null pointer dereference.