CVE-2021-41918

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/Exploit, Third Party Advisory
https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/Exploit, Third Party Advisory

Timeline

Published: Oct 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-419198.8webTareas version 2.4 and earlier allows an authenticated user to arbitrarily upload potentially dangerous files without restrictions. This CVE-2021-41927.8vim is vulnerable to Use After Free CVE-2021-419207.5webTareas version 2.4 and earlier allows an unauthenticated user to perform Time and Boolean-based blind SQL Injection on the endpoint /incl CVE-2021-419219.8novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code ex CVE-2021-419246.1Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).CVE-2021-419289.8SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code vi CVE-2021-419296.1Cross Site Scripting (XSS) in Sourcecodester The Electric Billing Management System 1.0 by oretnom23, allows attackers to execute arbitrary CVE-2021-41935.5vim is vulnerable to Out-of-bounds Read CVE-2021-419306.1Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid Vaccination Scheduler System v1 by oretnom23, allows attackers to ex CVE-2021-419319.8The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection CVE-2021-419328.8A blind SQL injection vulnerability in search form in TeamMate+ Audit version 28.0.19.0 allows any authenticated user to create malicious SQ CVE-2021-419387.2An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three lo