CVE-2021-36605

Published: Jul 30, 2021Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser.

Affected (1)

Products: Engineercms Project: Engineercms

Engineercms Project

1 product

Engineercms

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Engineercms Project Engineercms	Version 1.03

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/3xxx/engineercms/issues/52

Source: cve@mitre.org

ExploitIssue TrackingThird Party Advisory

https://github.com/3xxx/engineercms/issues/52

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

Timeline

No history available yet.