Vulnerability Description
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript, and the application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://www.exploit-db.com/exploits/50611
- https://www.exponentcms.org/
- https://www.vulncheck.com/advisories/exponent-cms-multiple-vulnerabilities-store
FAQ
What is CVE-2021-47931?
CVE-2021-47931 is a vulnerability with a CVSS score of 6.4 (MEDIUM). Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing en...
How severe is CVE-2021-47931?
CVE-2021-47931 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-47931?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.