CVE-2021-36737

CVE-2021-36737 affects Apache Pluto UrlTestPortlet within the v3-demo-portlet.war. The input fields are vulnerable to Cross-Site Scripting (XSS) due to insufficient input escaping in UrlTestPortlet, enabling injection of script code. The issue is documented across multiple feeds (NVD/Red Hat/CNVD...

CVE-2021-36738

The CVE-2021-36738 entry describes a Cross‑Site Scripting (XSS) vulnerability in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet. The issue arises in input fields and is mitigated by upgrading to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact. Affected produ...