CVE-2021-37393

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page

published July 26, 2021

CVSS
—
EPSS
1%
Percentile
43.8
In the wild
Unconfirmed
What it is

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00527 · 43.8th percentile
Published
2021-07-26T17:05Z
EPSS history
Timeline
  • 26 JUL 17:05Z
    In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page
    cvelistv5