CVE-2021-41878

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in the i-Panel Administration System Version 2.0 that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console and it is possible to insert a vulnerable malicious button.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/164519/i-Panel-Administration-System-2.0-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://cybergroot.com/cve_submission/2021-1/XSS_i-Panel_2.0.htmlExploit, Third Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41878Third Party Advisory
http://packetstormsecurity.com/files/164519/i-Panel-Administration-System-2.0-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
https://cybergroot.com/cve_submission/2021-1/XSS_i-Panel_2.0.htmlExploit, Third Party Advisory
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41878Third Party Advisory

Timeline

Published: Oct 4, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41887.5mruby is vulnerable to NULL Pointer Dereference CVE-2021-41895.3A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP CVE-2021-41907.5Large loop in the Kafka dissector in Wireshark 3.6.0 allows denial of service via packet injection or crafted capture file CVE-2021-41915.3An issue has been discovered in GitLab CE/EE affecting versions 13.0 to 14.6.5, 14.7 to 14.7.4, and 14.8 to 14.8.2. Private GitLab instances CVE-2021-419168.8A Cross-Site Request Forgery (CSRF) vulnerability in webTareas version 2.4 and earlier allows a remote attacker to create a new administrati CVE-2021-419175.4webTareas version 2.4 and earlier allows an authenticated user to store arbitrary web script or HTML by creating or editing a client name in CVE-2021-419185.4webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-CVE-2021-419198.8webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This CVE-2021-41927.8vim is vulnerable to Use After Free CVE-2021-419207.5webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /incl CVE-2021-419219.8novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code ex CVE-2021-419246.1Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).