CVE-2021-41420

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A stored XSS vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker for arbitrary JavaScript code execution in the context of authenticated and unauthenticated users through the MaianAffiliate admin panel.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS/blob/main/README.mdExploit, Third Party Advisory
https://www.maianaffiliate.com/Vendor Advisory
https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS/blob/main/README.mdExploit, Third Party Advisory
https://www.maianaffiliate.com/Vendor Advisory

Timeline

Published: Jun 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-414214.8A PHP code injection vulnerability in MaianAffiliate v.1.0 allows an authenticated attacker to gain RCE through the MaianAffiliate admin pan CVE-2021-414268.8Beeline Smart box 2.0.38 is vulnerable to Cross Site Request Forgery (CSRF) via mgt_end_user.htm.CVE-2021-414276.1Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.CVE-2021-41436.1Cross-site Scripting (XSS) - Generic in GitHub repository bigbluebutton/bigbluebutton prior to 2.4.0.CVE-2021-414325.4A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands throu CVE-2021-414339.8SQL Injection vulnerability exists in version 1.0 of the Resumes Management and Job Application Website application login form by EGavilan M CVE-2021-414345.4A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitra CVE-2021-414359.8A brute-force protection bypass in CAPTCHA protection in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, R CVE-2021-414367.5An HTTP request smuggling in web application in ASUS ROG Rapture GT-AX11000, RT-AX3000, RT-AX55, RT-AX56U, RT-AX56U_V2, RT-AX58U, RT-AX82U, CVE-2021-414376.5An HTTP response splitting attack in web application in ASUS RT-AX88U before v3.0.0.4.388.20558 allows an attacker to craft a specific URL t CVE-2021-41448.8TP-Link wifi router TL-WR802N V4(JP), with firmware version prior to 211202, is vulnerable to OS command injection.CVE-2021-414417.4A DoS attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to reboot the router