CVE-2021-45281

2022-02-0722:15:08

Google

osv.dev

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.0%

JSON

QuickBox Pro v2.4.8 contains a cross-site scripting (XSS) vulnerability at “adminuseredit.php?usertoedit=XSS”, as the user supplied input for the value of this parameter is not properly sanitized.

CPENameOperatorVersion
qbeq2.5.2
qbeq2.5.7
qbeq2.5.0
qbeq2.5.3
qbeq2.5.5
qbeq2.5.1
qbeq2.5.4
qbeq2.5.8
qbeq2.4.9
qbeq2.5.6

Name	Operator	Version
qb	eq	2.5.2
qb	eq	2.5.7
qb	eq	2.5.0
qb	eq	2.5.3
qb	eq	2.5.5
qb	eq	2.5.1
qb	eq	2.5.4
qb	eq	2.5.8
qb	eq	2.4.9
qb	eq	2.5.6

References

websec.nl/blog/61b2b37a43a1155c848f3b08/developing%20a%20remote%20code%20execution%20exploit%20for%20a%20popular%20media%20box