CVE-2021-45903

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35Release Notes, Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_2Release Notes, Vendor Advisory
https://github.com/ach-ing/cves/blob/main/CVE-2021-45903.mdThird Party Advisory
https://docs.suitecrm.com/admin/releases/7.10.x/#_7_10_35Release Notes, Vendor Advisory
https://docs.suitecrm.com/admin/releases/7.12.x/#_7_12_2Release Notes, Vendor Advisory
https://github.com/ach-ing/cves/blob/main/CVE-2021-45903.mdThird Party Advisory

Timeline

Published: Dec 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-459045.4OpenWrt 21.02.1 allows XSS via the Port Forwards Add Name screen.CVE-2021-459055.4OpenWrt 21.02.1 allows XSS via the Traffic Rules Name screen.CVE-2021-459065.4OpenWrt 21.02.1 allows XSS via the NAT Rules Name screen.CVE-2021-459077.8An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over CVE-2021-459087.8An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a while loop. An attacker has little influence ove CVE-2021-459097.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow vulnerability in the DecodeLZW function. It allows an attacke CVE-2021-459107.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow within the main function. It allows an attacker to write data CVE-2021-459117.8An issue was discovered in gif2apng 1.9. There is a heap-based buffer overflow in the main function. It allows an attacker to write 2 bytes CVE-2021-459127.8An unauthenticated Named Pipe channel in Controlup Real-Time Agent (cuAgent.exe) before 8.5 potentially allows an attacker to run OS command CVE-2021-459137.2A hardcoded key in ControlUp Real-Time Agent (cuAgent.exe) before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel.CVE-2021-459149.8In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a POST request. This allows the attacker's session t CVE-2021-459159.8In LuxSoft LuxCal Web Calendar before 5.2.0, an unauthenticated attacker can manipulate a cookie value. This allows the attacker's session t