CVE-2021-40509

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164045/jforum-2.7.0-Cross-Site-Scripting.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2021/Sep/13Mailing List, Third Party Advisory
https://lists.openwall.net/full-disclosure/2021/09/03/7Exploit, Mailing List, Third Party Advisory
https://sourceforge.net/p/jforum2/code/934/Patch, Third Party Advisory
http://packetstormsecurity.com/files/164045/jforum-2.7.0-Cross-Site-Scripting.htmlThird Party Advisory
http://seclists.org/fulldisclosure/2021/Sep/13Mailing List, Third Party Advisory
https://lists.openwall.net/full-disclosure/2021/09/03/7Exploit, Mailing List, Third Party Advisory
https://sourceforge.net/p/jforum2/code/934/Patch, Third Party Advisory

Timeline

Published: Sep 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-405107.5XML eXternal Entity (XXE) in OBDA systems’ Mastro 1.0 allows remote attackers to read system files via custom DTDs.CVE-2021-405117.5OBDA systems’ Mastro 1.0 is vulnerable to XML Entity Expansion (aka “billion laughs”) attack allowing denial of service.CVE-2021-405167.5WeeChat before 3.2.1 allows remote attackers to cause a denial of service (crash) via a crafted WebSocket frame that trigger an out-of-bound CVE-2021-405175.4Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the u CVE-2021-405186.5Airangel HSMX Gateway devices through 5.2.04 allow CSRF.CVE-2021-4051910.0Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.CVE-2021-40528.8Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension CVE-2021-405209.8Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.CVE-2021-405219.8Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.CVE-2021-405237.5In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the W CVE-2021-405247.5In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, whic CVE-2021-405259.1Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading