CVE-2021-47725 | THREATINT

Description

STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the affected site.

PUBLISHED Reserved 2025-12-07 | Published 2025-12-31 | Updated 2026-01-02 | Assigner VulnCheck

MEDIUM: 4.8CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

MEDIUM: 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Problem types

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

5.9.10

affected

5.9.9

affected

5.9.7

affected

5.9.1

affected

5.9.0

affected

5.8.6

affected

5.7

affected

5.6

affected

5.5

affected

Credits

LiquidWorm as Gjoko Krstic of Zero Science Lab finder

References

www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5624.php (Zero Science Lab Disclosure (ZSL-2021-5624)) third-party-advisory

packetstormsecurity.com/...-5.9.10-Cross-Site-Scripting.html (Packet Storm Security Exploit Entry) exploit

cxsecurity.com/issue/WLB-2021010188 (CXSecurity Vulnerability Listing) third-party-advisory

exchange.xforce.ibmcloud.com/vulnerabilities/195723 (IBM X-Force Vulnerability Exchange) vdb-entry

stvs.com/ (Vendor Homepage) product

www.vulncheck.com/...ross-site-scripting-via-files-parameter (VulnCheck Advisory: STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files Parameter) third-party-advisory

cve.org (CVE-2021-47725)

nvd.nist.gov (CVE-2021-47725)

Download JSON