CVE-2021-25791

Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields.

CVSS v3.1

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

3.5 LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

EPSS

2.54% chance of exploitation in the next 30 days, 84th percentile

Published

2021-07-23

Updated

2024-08-03

Proof-of-concept exploits (1)

• MrCraniums/CVE-2021-25791-Multiple-Stored-XSS1★ · 2021-08-16

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49396

References

• CVE Record
• NVD entry

Related

• CVE-2021-25790
• CVE-2021-25829
• CVE-2021-25786
• CVE-2021-25830
• CVE-2021-25785
• CVE-2021-25831