CVE-2021-40517

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Nov 10, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-405186.5Airangel HSMX Gateway devices through 5.2.04 allow CSRF.CVE-2021-4051910.0Airangel HSMX Gateway devices through 5.2.04 have Hard-coded Database Credentials.CVE-2021-40528.8Use after free in web apps in Google Chrome prior to 96.0.4664.93 allowed an attacker who convinced a user to install a malicious extension CVE-2021-405209.8Airangel HSMX Gateway devices through 5.2.04 have Weak SSH Credentials.CVE-2021-405219.8Airangel HSMX Gateway devices through 5.2.04 allow Remote Code Execution.CVE-2021-405237.5In Contiki 3.0, Telnet option negotiation is mishandled. During negotiation between a server and a client, the server may fail to give the W CVE-2021-405247.5In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, whic CVE-2021-405259.1Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading CVE-2021-405265.3Incorrect calculation of buffer size vulnerability in Peleton TTR01 up to and including PTV55G allows a remote attacker to trigger a Denial CVE-2021-405277.5Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.CVE-2021-405285.9The ElGamal implementation in Libgcrypt before 1.9.4 allows plaintext recovery because, during interaction between two cryptographic librari CVE-2021-405295.9The ElGamal implementation in Botan through 2.18.1, as used in Thunderbird and other products, allows plaintext recovery because, during int