CVE-2021-30171CWE-79

Jun-He Technology Ltd. ERP POS - Stored XSS-2

Medium · published May 7, 2021

CVSS v3.1
4.6
EPSS
1%
Percentile
47.3
In the wild
Unconfirmed
What it is

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00586 · 47.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-05-07T09:30Z
EPSS history
Timeline
  • 07 MAY 09:30Z
    Jun-He Technology Ltd. ERP POS - Stored XSS-2
    cvelistv5