CVE-2021-20792

Published: Aug 18, 2021Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

Cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.1.14 allows a remote attacker to inject arbitrary script via unspecified vectors.

Affected (1)

Products: Expresstech: Quiz And Survey Master

Expresstech

1 product

Quiz And Survey Master

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Expresstech Quiz And Survey Master	Before 7.1.14

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (8)

https://jvn.jp/en/jp/JVN65388002/index.html

Source: vultures@jpcert.or.jp

Third Party Advisory

https://plugins.trac.wordpress.org/changeset?new=2503364%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php

Source: vultures@jpcert.or.jp

PatchThird Party Advisory

https://quizandsurveymaster.com/

Source: vultures@jpcert.or.jp

Product

https://wordpress.org/plugins/quiz-master-next/

Source: vultures@jpcert.or.jp

ProductRelease Notes

https://jvn.jp/en/jp/JVN65388002/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://plugins.trac.wordpress.org/changeset?new=2503364%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php&old=2490516%40quiz-master-next%2Ftrunk%2Fphp%2Fadmin%2Fquizzes-page.php

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://quizandsurveymaster.com/

Source: af854a3a-2127-422b-91ae-364da2661108

Product

https://wordpress.org/plugins/quiz-master-next/

Source: af854a3a-2127-422b-91ae-364da2661108

ProductRelease Notes

Timeline

No history available yet.