CVE-2021-30133

A cross-site scripting (XSS) vulnerability in CloverDX Server 5.9.0, CloverDX 5.8.1, CloverDX 5.7.0, and earlier allows remote attackers to inject arbitrary web script or HTML via the sessionToken parameter of multiple methods in Simple HTTP API. This is resolved in 5.9.1 and 5.10.

• CWE-79

• https://support.cloverdx.com/releases/Release Notes, Vendor Advisory
• https://support1.cloverdx.com/hc/en-us/articles/360021006520Patch, Vendor Advisory
• https://support.cloverdx.com/releases/Release Notes, Vendor Advisory
• https://support1.cloverdx.com/hc/en-us/articles/360021006520Patch, Vendor Advisory

Published

Jun 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30127TerraMaster F2-210 devices through 2021-04-03 use UPnP to ma…7.3
• CVE-2021-30128Apache OFBiz has unsafe deserialization prior to 17.12.07 ve…9.8
• CVE-2021-30129A vulnerability in sshd-core of Apache Mina SSHD allows an a…6.5
• CVE-2021-3013ripgrep before 13 on Windows allows attackers to trigger exe…9.8
• CVE-2021-30130phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA …7.5
• CVE-2021-30132Cloudera Manager 7.2.4 has Incorrect Access Control, allowin…9.8
• CVE-2021-30134php-mod/curl (a wrapper of the PHP cURL extension) before 2.…6.1
• CVE-2021-30137Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XM…8.2
• CVE-2021-30138Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-30139In Alpine Linux apk-tools before 2.12.5, the tarball parser …7.5
• CVE-2021-3014In MikroTik RouterOS through 2021-01-04, the hotspot login p…6.1
• CVE-2021-30140LiquidFiles 3.4.15 has stored XSS through the "send email" f…5.4