CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page

published July 26, 2021

CVSS
—
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Published
2021-07-26T17:03Z
EPSS history
Timeline
  • 26 JUL 17:03Z
    In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page
    cvelistv5