CVE-2021-4107

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
yetiforcecompany	yetiforcecompany/yetiforcecrm	>= unspecified, < 6.4.0

References

https://github.com/yetiforcecompany/yetiforcecrm/commit/a062d3d5fecb000db207a2ad8a446db97ad96b89Patch, Third Party Advisory
https://huntr.dev/bounties/1d124520-cf29-4539-a0f3-6d041af7b5a8Exploit, Patch, Third Party Advisory
https://github.com/yetiforcecompany/yetiforcecrm/commit/a062d3d5fecb000db207a2ad8a446db97ad96b89Patch, Third Party Advisory
https://huntr.dev/bounties/1d124520-cf29-4539-a0f3-6d041af7b5a8Exploit, Patch, Third Party Advisory

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-410728.1squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs CVE-2021-410737.8loop_rw_iter in fs/io_uring.c in the Linux kernel 5.10 through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFE CVE-2021-410745.4A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML documen CVE-2021-410759.8The NetFlow Analyzer in Zoho ManageEngine OpManger before 125455 is vulnerable to SQL Injection in the Attacks Module API.CVE-2021-410777.5The activation process in Travis CI, for certain 2021-09-03 through 2021-09-10 builds, causes secret data to have unexpected sharing that is CVE-2021-410787.8Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.CVE-2021-410797.5Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was co CVE-2021-41086.1snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-410809.8Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a hardware details search.CVE-2021-410819.8Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.CVE-2021-410827.5Discourse is a platform for community discussion. In affected versions any private message that includes a group had its title and participa CVE-2021-410838.8Dada Mail is a web-based e-mail list management system. In affected versions a bad actor could give someone a carefully crafted web page via