CVE-2021-25790

Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0 NVD

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

0.88% chance of exploitation in the next 30 days, 58th percentile

Published

2021-07-23

Updated

2024-08-03

Proof-of-concept exploits (1)

• MrCraniums/CVE-2021-25790-Multiple-Stored-XSS1★ · 2021-08-16

Security advisories

• https://www.exploit-db.com/exploits/49352
• https://www.sourcecodester.com
• https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-sourc…

References

• CVE Record
• NVD entry

Related

• CVE-2021-25791