CVE-2021-41557

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section (or change existing work orders). The XSS payload is in the work order number.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/165278/Sofico-Miles-RIA-2020.2-Build-127964T-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.sofico.globalVendor Advisory
http://packetstormsecurity.com/files/165278/Sofico-Miles-RIA-2020.2-Build-127964T-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://www.sofico.globalVendor Advisory

Timeline

Published: Dec 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-415589.8The set_user extension module before 3.0.0 for PostgreSQL allows ProcessUtility_hook bypass via set_config.CVE-2021-415596.5Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML docu CVE-2021-41567.1An out-of-bounds read flaw was found in libsndfile's FLAC codec functionality. An attacker who is able to submit a specially crafted file (v CVE-2021-415609.8OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.CVE-2021-415617.5Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue aff CVE-2021-415626.1A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow A CVE-2021-415636.1Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and exec CVE-2021-415646.5Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete artic CVE-2021-415656.1TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syn CVE-2021-415669.8The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arb CVE-2021-415676.1The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remo CVE-2021-415686.5Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing b