CVE-2021-45787

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-457888.8Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.CVE-2021-457896.5An arbitrary file read vulnerability was found in Metersphere v1.15.4, where authenticated users can read any file on the server via the fil CVE-2021-457909.8An arbitrary file upload vulnerability was found in Metersphere v1.15.4. Unauthenticated users can upload any file to arbitrary directory, w CVE-2021-457918.8Slims8 Akasia 8.3.1 is affected by SQL injection in /admin/modules/bibliography/index.php, /admin/modules/membership/member_type.php, /admin CVE-2021-457924.8Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.CVE-2021-457937.5Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained.CVE-2021-457947.5Slims9 Bulian 9.4.2 is affected by SQL injection in /admin/modules/system/backup.php. User data can be obtained.CVE-2021-458029.8MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because the email and phone parameter values are added to CVE-2021-458038.8MartDevelopers iResturant 1.0 is vulnerable to SQL Injection. SQL Injection occurs because this view parameter value is added to the SQL que CVE-2021-458068.8jpress v4.2.0 admin panel provides a function through which attackers can modify the template and inject some malicious code.CVE-2021-458079.8jpress v4.2.0 is vulnerable to command execution via io.jpress.web.admin._AddonController::doUploadAndInstall.CVE-2021-458088.8jpress v4.2.0 allows users to register an account by default. With the account, user can upload arbitrary files to the server.