CVE-2021-42050

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/abantecart/abantecart-src/releasesRelease Notes, Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-abantecart-e-commerce-platform/Exploit, Third Party Advisory
https://github.com/abantecart/abantecart-src/releasesRelease Notes, Third Party Advisory
https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-in-abantecart-e-commerce-platform/Exploit, Third Party Advisory

Timeline

Published: Dec 14, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-420515.4An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document CVE-2021-420527.5IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and th CVE-2021-420535.4The Unicorn framework through 0.35.3 for Django allows XSS via component.name.CVE-2021-420547.5ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.CVE-2021-420556.8ASUSTek ZenBook Pro Due 15 UX582 laptop firmware through 203 has Insecure Permissions that allow attacks by a physically proximate attacker.CVE-2021-420566.7Thales Safenet Authentication Client (SAC) for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a loc CVE-2021-420577.8Obsidian Dataview through 0.4.12-hotfix1 allows eval injection. The evalInContext function in executes user input, which allows an attacker CVE-2021-420596.7An issue was discovered in Insyde InsydeH2O Kernel 5.0 before 05.08.41, Kernel 5.1 before 05.16.41, Kernel 5.2 before 05.26.41, Kernel 5.3 b CVE-2021-42068.2A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation CVE-2021-420608.2An issue was discovered in Insyde InsydeH2O Kernel 5.0 through 05.08.41, Kernel 5.1 through 05.16.41, Kernel 5.2 before 05.23.22, and Kernel CVE-2021-420615.4SAP BusinessObjects Business Intelligence Platform (Web Intelligence) - version 420, does not sufficiently encode user-controlled inputs, re CVE-2021-420624.3SAP ERP HCM Portugal does not perform necessary authorization checks for a report that reads the payroll data of employees in a certain area