CVE-2021-41502

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415038.0DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices co CVE-2021-415048.0An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the dev CVE-2021-415069.8Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R CVE-2021-415119.8The username and password field of login in Lodging Reservation Management System V1 can give access to any user by using SQL injection to b CVE-2021-415247.5While fuzzing the 2.4.49 httpd, a new null pointer dereference was detected during HTTP/2 request processing, allowing an external source to CVE-2021-415255.5An issue related to modification of otherwise restricted files through a locally authenticated attacker exists in FlexNet inventory agent an CVE-2021-415267.8A vulnerability has been reported in the windows installer (MSI) built with InstallScript custom action. This vulnerability may allow privil CVE-2021-415272.3An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited CVE-2021-415285.3An error when handling authorization related to the import / export interfaces on the RISC Platform prior to the saas-2021-12-29 release can CVE-2021-415307.5Forcepoint NGFW Engine versions 6.5.11 and earlier, 6.8.6 and earlier, and 6.10.0 are vulnerable to TCP reflected amplification vulnerabilit CVE-2021-415317.5NLnet Labs Routinator prior to 0.10.0 produces invalid RTR payload if an RPKI CA uses too large values in the max-length parameter in a ROA.CVE-2021-415325.3In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user c