Vulnerability Details CVE-2021-31674
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.022
EPSS Ranking 84.2%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- http://cyclos.com
- https://tf1t.gitbook.io/mycve/cylos/cyclos-4.14.7-dom-based-cross-site-scripting-in-undefined-enum-cve-2021-31674
- https://www.exploit-db.com/exploits/50908
- http://cyclos.com
- https://tf1t.gitbook.io/mycve/cylos/cyclos-4.14.7-dom-based-cross-site-scripting-in-undefined-enum-cve-2021-31674
- https://www.exploit-db.com/exploits/50908