CVE-2021-47795

GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper input sanitization. Attackers can exploit the WebStrings.srf endpoint by manipulating path traversal and injection parameters to access system files and execute malicious scripts.

CVSS v4.0

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1

6.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

2.61% chance of exploitation in the next 30 days, 84th percentile

Nuclei

high · CWE-22

Published

2026-01-15

Updated

2026-04-07

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/50211

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-47795.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2021-47794
• CVE-2021-47796
• CVE-2021-47793
• CVE-2021-47797
• CVE-2021-47792
• CVE-2021-47798