CVE-2021-40238

Published: Sep 15, 2021Modified: Jun 17, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.

Affected (1)

Products: Webuzo: Webuzo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webuzo Webuzo	Before 2.9.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (4)

https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e

Source: cve@mitre.org

Third Party Advisory

https://www.webuzo.com/blog/webuzo-2-9-0-launched/

Source: cve@mitre.org

Release NotesVendor Advisory

https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.webuzo.com/blog/webuzo-2-9-0-launched/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.