CVE-2021-41318

MediumCVSS 6.1/10Last modified Sep 25, 2026

Description

In Progress WhatsUp Gold prior to version 21.1.0, an application endpoint failed to adequately sanitize malicious input. which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164359/WhatsUpGold-21.0.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://knowledgebase.progress.com/articles/Knowledge/WhatsUp-Gold-Security-Bulletin-September-2021Vendor Advisory
http://packetstormsecurity.com/files/164359/WhatsUpGold-21.0.3-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://knowledgebase.progress.com/articles/Knowledge/WhatsUp-Gold-Security-Bulletin-September-2021Vendor Advisory

Timeline

Published: Sep 28, 2021
Last modified: Sep 25, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41325.4livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-413205.5A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authentica CVE-2021-413228.8Poly VVX 400/410 5.3.1 allows low-privileged users to change the Admin password by modifying a POST parameter to 120 during the password res CVE-2021-413236.5Directory traversal in the Compress feature in Pydio Cells 2.2.9 allows remote authenticated users to overwrite personal files, or Cells fil CVE-2021-413246.5Directory traversal in the Copy, Move, and Delete features in Pydio Cells 2.2.9 allows remote authenticated users to enumerate personal file CVE-2021-413256.5Broken access control for user creation in Pydio Cells 2.2.9 allows remote anonymous users to create standard users via the profile paramete CVE-2021-413269.8In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.CVE-2021-413296.5Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their vie CVE-2021-41338.8A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new CVE-2021-413307.8Microsoft Windows Media Foundation Remote Code Execution Vulnerability CVE-2021-413317.8Windows Media Audio Decoder Remote Code Execution Vulnerability CVE-2021-413326.5Windows Print Spooler Information Disclosure Vulnerability