CVE-2021-41132

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Oct 14, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-411337.8Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0,CVE-2021-411345.4nbdime provides tools for diffing and merging of Jupyter Notebooks. In affected versions a stored cross-site scripting (XSS) issue exists wiCVE-2021-411356.5The Cosmos-SDK is a framework for building blockchain applications in Golang. Affected versions of the SDK were vulnerable to a consensus haCVE-2021-411363.7Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using `puma` with a proxy which forwards HTTP headeCVE-2021-411378.8Minio is a Kubernetes native application for cloud storage. All users on release `RELEASE.2021-10-10T16-53-30Z` are affected by a vulnerabilCVE-2021-411385.3Frontier is Substrate's Ethereum compatibility layer. In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a laCVE-2021-411396.1Anuko Time Tracker is an open source, web-based time tracking application written in PHP. When a logged on user selects a date in Time TrackCVE-2021-411405.3Discourse-reactions is a plugin for the Discourse platform that allows user to add their reactions to the post. In affected versions reactioCVE-2021-411417.5PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIPCVE-2021-411425.4Tuleap Open ALM is a libre and open source tool for end to end traceability of application and system developments. There is a cross-site scCVE-2021-411437.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could eCVE-2021-411448.8OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to exec
CVE-2021-41132: Medium severity, CVSS 6.1 | Vulnix