CVE-2021-25933

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms.

• CWE-79
• CWE-79

• https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01%2C
• https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98cPatch, Third Party Advisory
• https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10ePatch, Third Party Advisory
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25933Exploit, Third Party Advisory
• https://github.com/OpenNMS/opennms/commit/8a97e6869d6e49da18b208c837438ace80049c01%2C
• https://github.com/OpenNMS/opennms/commit/eb08b5ed4c5548f3e941a1f0d0363ae4439fa98cPatch, Third Party Advisory
• https://github.com/OpenNMS/opennms/commit/f3ebfa3da5352b4d57f238b54c6db315ad99f10ePatch, Third Party Advisory
• https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25933Exploit, Third Party Advisory

Published

May 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-25927Prototype pollution vulnerability in 'safe-flat' versions 2.…9.8
• CVE-2021-25928Prototype pollution vulnerability in 'safe-obj' versions 1.0…9.8
• CVE-2021-25929In OpenNMS Horizon, versions opennms-1-0-stable through open…4.8
• CVE-2021-25930In OpenNMS Horizon, versions opennms-1-0-stable through open…4.3
• CVE-2021-25931In OpenNMS Horizon, versions opennms-1-0-stable through open…8.8
• CVE-2021-25932In OpenNMS Horizon, versions opennms-1-0-stable through open…5.4
• CVE-2021-25934In OpenNMS Horizon, versions opennms-18.0.0-1 through opennm…5.4
• CVE-2021-25935In OpenNMS Horizon, versions opennms-17.0.0-1 through opennm…5.4
• CVE-2021-25938In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerabl…6.1
• CVE-2021-25939In ArangoDB, versions v3.7.0 through v3.9.0-alpha.1 have a f…2.7
• CVE-2021-25940In ArangoDB, versions v3.7.6 through v3.8.3 are vulnerable t…8
• CVE-2021-25941Prototype pollution vulnerability in 'deep-override' version…9.8