CVE-2021-25277

FTAPI 4.0 - 4.10 allows XSS via a crafted filename to the alternative text hover box in the file submission component.

• CWE-79

• https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25277Exploit, Third Party Advisory
• https://www.ftapi.com/release-notes/Release Notes, Vendor Advisory
• https://github.com/rauschecker/CVEs/tree/main/CVE-2021-25277Exploit, Third Party Advisory
• https://www.ftapi.com/release-notes/Release Notes, Vendor Advisory

Published

Mar 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25270A local attacker could execute arbitrary code with administr…6.7
• CVE-2021-25271A local attacker could read or write arbitrary files with ad…6
• CVE-2021-25273Stored XSS can execute as administrator in quarantined email…4.8
• CVE-2021-25274The Collector Service in SolarWinds Orion Platform before 20…9.8
• CVE-2021-25275SolarWinds Orion Platform before 2020.2.4, as used by variou…7.8
• CVE-2021-25276In SolarWinds Serv-U before 15.2.2 Hotfix 1, there is a dire…7.1
• CVE-2021-25278FTAPI 4.0 through 4.10 allows XSS via an SVG document to the…4.8
• CVE-2021-25281An issue was discovered in through SaltStack Salt before 300…9.8
• CVE-2021-25282An issue was discovered in through SaltStack Salt before 300…9.1
• CVE-2021-25283An issue was discovered in through SaltStack Salt before 300…9.8
• CVE-2021-25284An issue was discovered in through SaltStack Salt before 300…4.4
• CVE-2021-25287An issue was discovered in Pillow before 8.2.0. There is an …9.1