CVEDB API

Thinfinity VirtualUI before 3.0 has functionality in /lab.html reachable by default that could allow IFRAME injection via the vpath parameter.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.88

EPSS Ranking 99.4%

CVSS Severity

CVSS v3 Score 9.8

CVSS v2 Score 7.5

References

Products affected by CVE-2021-45092

Cybelesoft » Thinfinity Virtualui » Version: 2.0

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.0
Cybelesoft » Thinfinity Virtualui » Version: 2.1.28.0

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.1.28.0
Cybelesoft » Thinfinity Virtualui » Version: 2.1.32.1

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.1.32.1
Cybelesoft » Thinfinity Virtualui » Version: 2.5

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.5
Cybelesoft » Thinfinity Virtualui » Version: 2.5.17.2

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.5.17.2
Cybelesoft » Thinfinity Virtualui » Version: 2.5.26.2

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.5.26.2
Cybelesoft » Thinfinity Virtualui » Version: 2.5.41.0

cpe:2.3:a:cybelesoft:thinfinity_virtualui:2.5.41.0