CVE-2021-47737CWE-79

CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard

Medium · published December 23, 2025

CVSS v4.0
5.1
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft POST requests to the member messaging system with HTML-based links to potentially conduct phishing or social engineering attacks.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-12-23T19:35Z
EPSS history
Timeline
  • 23 DEC 19:35Z
    CSZ CMS 1.2.7 HTML Injection Vulnerability via Member Dashboard
    cvelistv5