CVE-2021-30140

LiquidFiles 3.4.15 has stored XSS through the "send email" functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content), the payload is executed upon a click. This is fixed in 3.5.

• CWE-79

• http://packetstormsecurity.com/files/167228/LiquidFiles-3.4.15-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/41Exploit, Mailing List, Third Party Advisory
• https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167Exploit, Third Party Advisory
• https://liquidfiles.com/support.htmlVendor Advisory
• https://www.tempest.com.brNot Applicable
• http://packetstormsecurity.com/files/167228/LiquidFiles-3.4.15-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2022/May/41Exploit, Mailing List, Third Party Advisory
• https://gist.github.com/rodnt/9f7d368fac38cafa7334598ec94fb167Exploit, Third Party Advisory
• https://liquidfiles.com/support.htmlVendor Advisory
• https://www.tempest.com.brNot Applicable

Published

Apr 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30133A cross-site scripting (XSS) vulnerability in CloverDX Serve…6.1
• CVE-2021-30134php-mod/curl (a wrapper of the PHP cURL extension) before 2.…6.1
• CVE-2021-30137Assyst 10 SP7.5 has authenticated XXE leading to SSRF via XM…8.2
• CVE-2021-30138Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-30139In Alpine Linux apk-tools before 2.12.5, the tarball parser …7.5
• CVE-2021-3014In MikroTik RouterOS through 2021-01-04, the hotspot login p…6.1
• CVE-2021-30141Module/Settings/UserExport.php in Friendica through 2021.01 …7.5
• CVE-2021-30144The Dashboard plugin through 1.0.2 for GLPI allows remote lo…4.3
• CVE-2021-30145A format string vulnerability in mpv through 0.33.0 allows u…7.8
• CVE-2021-30146Seafile 7.0.5 (2019) allows Persistent XSS via the "share of…5.4
• CVE-2021-30147DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts su…8.8
• CVE-2021-30149Composr 10.0.36 allows upload and execution of PHP files.9.8