QSearchQSearch

CVE-2021-41567

6.1 MEDIUM

The new add subject parameter of Tad Uploader view book list function fails to filter special characters

Published: 2021-10-08 · Last updated: 2026-06-17

Severity and scoring

CVSS
6.1 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
CWE-79

Affected products

VendorProduct
tad_uploader_projecttad_uploader

Description

The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2021-41976 — Tad Uploader edit book list function is vulnerable to authorization bypass, thus remote attackers can use the function to amend the folde... (5.3 MEDIUM)

Same CWE

  • CVE-2026-12425 — Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access ...
  • CVE-2024-30476 — PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager (5.4 MEDIUM)
  • CVE-2026-54198 — Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions (7.1 HIGH)
  • CVE-2026-54191 — Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions (7.1 HIGH)
  • CVE-2026-39437 — Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions (7.1 HIGH)