CVE-2021-40238

6.1 MEDIUM

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which...

Published: 2021-09-15 · Last updated: 2026-06-17

Severity and scoring

CVSS: 6.1 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Affected products

Vendor	Product
webuzo	webuzo

Description

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-40238
[Other]https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e
[Vendor advisory]https://www.webuzo.com/blog/webuzo-2-9-0-launched/
[Other]https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8e
[Vendor advisory]https://www.webuzo.com/blog/webuzo-2-9-0-launched/

Related CVEs

Same CWE

CVE-2026-12425 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access ...
CVE-2024-30476 — PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager (5.4 MEDIUM)
CVE-2026-54198 — Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions (7.1 HIGH)
CVE-2026-54191 — Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions (7.1 HIGH)
CVE-2026-39437 — Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions (7.1 HIGH)