CVE-2021-45422

MediumCVSS 6.1/10Last modified Jul 9, 2026

Description

Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/WlX-33/PoC-for-CVE/blob/main/CVE-2021-45422/RLM%2014.2%20Cross%20Site%20Scripting.txtExploit, Third Party Advisory
https://seclists.org/fulldisclosure/2022/Jan/31Exploit, Mailing List, Third Party Advisory
https://www.getinfosec.news/13202933/reprise-license-manager-142-reflected-cross-site-scripting#/Third Party Advisory
https://seclists.org/fulldisclosure/2022/Jan/31Exploit, Mailing List, Third Party Advisory
https://www.getinfosec.news/13202933/reprise-license-manager-142-reflected-cross-site-scripting#/Third Party Advisory

Timeline

Published: Jan 13, 2022
Last modified: Jul 9, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-454239.8A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c.. The array offsets_to_Names is dynamically all CVE-2021-454256.1Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes.CVE-2021-454279.8Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. An attacker can browse an CVE-2021-454289.8TLR-2005KSH is affected by an incorrect access control vulnerability. THe PUT method is enabled so an attacker can upload arbitrary files in CVE-2021-454295.5A Buffer Overflow vulnerablity exists in VirusTotal YARA git commit: 605b2edf07ed8eb9a2c61ba22eb2e7c362f47ba7 via yr_set_configuration in ya CVE-2021-454359.8An SQL Injection vulnerability exists in Sourcecodester Simple Cold Storage Management System using PHP/OOP 1.0 via the username field in lo CVE-2021-454407.8A unnecessary privilege vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security 10.0 SP1 (on-prem versions only) CVE-2021-454417.8A origin validation error vulnerability in Trend Micro Apex One (on-prem and SaaS) could allow a local attacker drop and manipulate a specia CVE-2021-454427.1A link following denial-of-service vulnerability in Trend Micro Worry-Free Business Security (on prem only) could allow a local attacker to CVE-2021-454447.8In zsh before 5.8.1, an attacker can achieve code execution if they control a command output inside the prompt, as demonstrated by a %F argu CVE-2021-454457.5Unisys ClearPath MCP TCP/IP Networking Services 59.1, 60.0, and 62.0 has an Infinite Loop.CVE-2021-454467.5A vulnerability in Hitachi Vantara Pentaho Business Analytics Server versions before 9.2.0.2 and 8.3.0.25 does not cascade the hidden pro