CVE-2021-25810

Cross site Scripting (XSS) vulnerability in MERCUSYS Mercury X18G 1.0.5 devices, via crafted values to the 'src_dport_start', 'src_dport_end', and 'dest_port' parameters.

• CWE-79

• https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Stored%20XSS.mdExploit, Third Party Advisory
• https://www.mercurycom.com.cn/product-521-1.htmlBroken Link
• https://www.mercusys.com/en/Vendor Advisory
• https://github.com/pokerfacett/MY_REQUEST/blob/master/Mercury%20Router%20X18g%20v1.0.5%20Stored%20XSS.mdExploit, Third Party Advisory
• https://www.mercurycom.com.cn/product-521-1.htmlBroken Link
• https://www.mercusys.com/en/Vendor Advisory

Published

Apr 29, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25801A buffer overflow vulnerability in the __Parse_indx componen…7.1
• CVE-2021-25802A buffer overflow vulnerability in the AVI_ExtractSubtitle c…7.1
• CVE-2021-25803A buffer overflow vulnerability in the vlc_input_attachment_…7.1
• CVE-2021-25804A NULL-pointer dereference in "Open" in avi.c of VideoLAN VL…7.5
• CVE-2021-25808A code injection vulnerability in backup/plugin.php of Bludi…7.8
• CVE-2021-25809UCMS 1.5.0 was discovered to contain a physical path leakage…5.3
• CVE-2021-25811MERCUSYS Mercury X18G 1.0.5 devices allow Denial of service …7.5
• CVE-2021-25812Command injection vulnerability in China Mobile An Lianbao W…9.8
• CVE-2021-25827Emby Server < 4.7.12.0 is vulnerable to a login bypass attac…9.8
• CVE-2021-25828Emby Server versions < 4.6.0.50 is vulnerable to Cross Site …6.1
• CVE-2021-25829An improper binary stream data handling issue was found in t…7.5
• CVE-2021-25830A file extension handling issue was found in [core] module o…9.8