CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

CVE-2021-37392

creationtimestamp| type| source ---|---|--- 2021-07-26 22:11:37+00:00| seen| https://t.me/cibsecurity/26508...

CVE-2021-37392

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will...

CVE-2021-37392

Summary: CVE-2021-37392 affects RPCMS v1.8 and earlier. The nickname field is not properly sanitized before display, enabling stored XSS when API functionality is enabled and an attacker updates a user nickname with an XSS payload; victims viewing articles by the injected user may trigger the XSS...