CVE-2021-41434

low-risk

Published 2022-09-28

A stored Cross-Site Scripting (XSS) vulnerability exists in version 1.0 of the Expense Management System application that allows for arbitrary execution of JavaScript commands through index.php.

Do I need to act?

0.38% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (1)

Expense Management System

Affected Vendors

Oretnom23

References (4)

Product https://egavilanmedia.com/Expense-Management-System/

Exploit https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-41434.md

Product https://egavilanmedia.com/Expense-Management-System/

Exploit https://github.com/martinkubecka/CVE-References/blob/main/CVE-2021-41434.md

/ 100

low-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal