p PatchFirst

CVE-2021-32853

CVE-2021-32853 · Erxes vulnerable to Cross-site Scripting

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.

CVSS 6.1 · Medium · EPSS 3.1% · Public exploit

Published
Updated

Stack: node

Affected products and versions

  • erxes

    Versions
    • ≥ 0.22.3, ≤ 0.22.3: Affected (custom)

    No fix published

  • erxes npm

    Affected ranges
    • SEMVER: ≤ 1.0.1

    No fix published

Original sources

Check your server →