CVE-2021-4139

CriticalCVSS 9.0/10Last modified Jun 17, 2026

Description

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
pimcorepimcore/pimcore>= unspecified, < 10.2.7

References

Timeline

Published
Dec 21, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-413908.0In Ericsson ECM before 18.0, it was observed that Security Provider Endpoint in the User Profile Management Section is vulnerable to CSV InjCVE-2021-413915.4In Ericsson ECM before 18.0, it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSCVE-2021-413929.8static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to theCVE-2021-413939.8Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situationsCVE-2021-413945.3Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.CVE-2021-413956.5Teleport before 6.2.12 and 7.x before 7.1.1 allows attackers to control a database connection string, in some situations, via a crafted dataCVE-2021-413967.5Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the eCVE-2021-414010.0It was possible to construct specific XSLT markup that would be able to bypass an iframe sandbox. This vulnerability affects Firefox ESR < 9CVE-2021-414028.8flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.CVE-2021-414039.8flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.CVE-2021-414089.8VoIPmonitor WEB GUI up to version 24.61 is affected by SQL injection through the "api.php" file and "user" parameter.CVE-2021-414119.8drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used corre
CVE-2021-4139: Critical severity, CVSS 9.0 | Vulnix