CVE-2021-45281

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at "adminuseredit.php?usertoedit=XSS", as the user supplied input for the value of this parameter is not properly sanitized.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://websec.nl/blog/61b2b37a43a1155c848f3b08/developing%20a%20remote%20code%20execution%20exploit%20for%20a%20popular%20media%20boxExploit, Third Party Advisory
https://websec.nl/blog/61b2b37a43a1155c848f3b08/developing%20a%20remote%20code%20execution%20exploit%20for%20a%20popular%20media%20boxExploit, Third Party Advisory

Timeline

Published: Feb 7, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-452865.3Directory Traversal vulnerability exists in ZZCMS 2021 via the skin parameter in 1) index.php, 2) bottom.php, and 3) top_index.php.CVE-2021-452885.5A Double Free vulnerability exists in filedump.c in GPAC 1.0.1, which could cause a Denail of Service via a crafted file in the MP4Box comma CVE-2021-452895.5A vulnerability exists in GPAC 1.0.1 due to an omission of security-relevant Information, which could cause a Denial of Service. The program CVE-2021-452907.5A Denial of Service vulnerability exits in Binaryen 103 due to an assertion abort in wasm::handle_unreachable.CVE-2021-452915.5The gf_dump_setup function in GPAC 1.0.1 allows malicoius users to cause a denial of service (Invalid memory address dereference) via a craf CVE-2021-452925.5The gf_isom_hint_rtp_read function in GPAC 1.0.1 allows attackers to cause a denial of service (Invalid memory address dereference) via a cr CVE-2021-452935.5A Denial of Service vulnerability exists in Binaryen 103 due to an Invalid memory address dereference in wasm::WasmBinaryBuilder::visitLet.CVE-2021-452975.5An infinite loop vulnerability exists in Gpac 1.0.1 in gf_get_bit_size.CVE-2021-453105.3Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access r CVE-2021-453257.5Server Side Request Forgery (SSRF) vulneraility exists in Gitea before 1.7.0 using the OpenID URL.CVE-2021-453268.8Cross Site Request Forgery (CSRF) vulnerability exists in Gitea before 1.5.2 via API routes.This can be dangerous especially with state alte CVE-2021-453279.8Gitea before 1.11.2 is affected by Trusting HTTP Permission Methods on the Server Side when referencing the vulnerable admin or user API. wh