CVE-2021-34370

Accela Civic Platform (versions up to 21.1; and affected earlier up to 20.1 in CVE-2021-34370) contains a Cross-Site Scripting vulnerability via ssoAdapter/logoutAction.do?successURL. The issue allows injection of arbitrary JavaScript in the victim’s browser, with potential data theft, session hi...

CVE-2021-33904

Accela Civic Platform

CVE-2021-34369

CVE-2021-34369 affects Accela Civic Platform (versions through 20.1). The vulnerability is an insecure direct object reference in the endpoint portlets/contact/ref/refContactDetail.do, where an attacker can modify contactSeqNumber to disclose sensitive data. The vendor notes that queried informat...

CVE-2016-5660

CVE-2016-5660 is an XSS vulnerability in the Accela Civic Platform Citizen Access portal, specifically in AttachmentsList.aspx via the iframeid parameter. The issue allows remote attackers to inject arbitrary web script or HTML. Documents indicate vulnerability details but do not specify affected...