CVE-2021-32737

Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection (cross-site-scripting) in the collection title. The problem is patched in version 1.6.41. As a workaround, one may manually patch the affected JavaScript files in lieu of updating.

• CWE-79
• CWE-79

• https://github.com/sulu/sulu/releases/tag/1.6.41Release Notes, Third Party Advisory
• https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8Third Party Advisory
• https://github.com/sulu/sulu/releases/tag/1.6.41Release Notes, Third Party Advisory
• https://github.com/sulu/sulu/security/advisories/GHSA-gm2x-6475-g9r8Third Party Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32731XWiki Platform is a generic wiki platform offering runtime s…5.3
• CVE-2021-32732### Impact It's possible to know if a user has or not an acc…6.5
• CVE-2021-32733Nextcloud Text is a collaborative document editing applicati…6.1
• CVE-2021-32734Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32735Kirby is a content management system. In Kirby CMS versions …5.4
• CVE-2021-32736think-helper defines a set of helper functions for ThinkJS. …7.5
• CVE-2021-32738js-stellar-sdk is a Javascript library for communicating wit…6.5
• CVE-2021-32739Icinga is a monitoring system which checks the availability …8.8
• CVE-2021-32740Addressable is an alternative implementation to the URI impl…7.5
• CVE-2021-32741Nextcloud Server is a Nextcloud package that handles data st…5.3
• CVE-2021-32742Vapor is a web framework for Swift. In versions 4.47.1 and p…9.1
• CVE-2021-32743Icinga is a monitoring system which checks the availability …8.8