CVE-2021-37470

2021-07-2520:08:15

mitre

www.cve.org

cve-2021-37470

persistent xss

nch webdictate v2.13

recipient name field

authenticated user

javascript injection

EPSS

0.001

Percentile

24.8%

JSON

In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.

References

github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md

www.nch.com.au/webdictate/index.html

EPSS

0.001

Percentile

24.8%

JSON

Related for CVELIST:CVE-2021-37470