CVE-2021-33849

A Cross-Site Scripting (XSS) attack can cause arbitrary code (JavaScript) to run in a user’s browser while the browser is connected to a trusted website. The attack targets your application's users and not the application itself while using your application as the attack's vehicle. The XSS payload executes whenever the user changes the form values or deletes a created form in Zoho CRM Lead Magnet Version 1.7.2.4.

• CWE-79

• https://cybersecurityworks.com/zerodays/cve-2020-29322-telnet-hardcoded-credentials.htmlNot Applicable
• https://cybersecurityworks.com/zerodays/cve-2021-33849-stored-cross-site-scripting-xss-in-wordpress-plugin-zoho-crm-lead-magnet-version-1-7-2-4.htmlExploit, Mitigation, Third Party Advisory
• https://cybersecurityworks.com/zerodays/cve-2020-29322-telnet-hardcoded-credentials.htmlNot Applicable
• https://cybersecurityworks.com/zerodays/cve-2021-33849-stored-cross-site-scripting-xss-in-wordpress-plugin-zoho-crm-lead-magnet-version-1-7-2-4.htmlExploit, Mitigation, Third Party Advisory

Published

Oct 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33843Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a defaul…5.3
• CVE-2021-33844A floating point exception (divide-by-zero) issue was discov…5.5
• CVE-2021-33845The Splunk Enterprise REST API allows enumeration of usernam…5.3
• CVE-2021-33846Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)…7.2
• CVE-2021-33847Improper buffer restrictions in firmware for some Intel(R) W…7.8
• CVE-2021-33848Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)…6.1
• CVE-2021-33850There is a Cross-Site Scripting vulnerability in Microsoft C…5.4
• CVE-2021-33851A cross-site scripting (XSS) attack can cause arbitrary code…5.4
• CVE-2021-33852A cross-site scripting (XSS) attack can cause arbitrary code…5.4
• CVE-2021-33853A Cross-Site Scripting (XSS) attack can cause arbitrary code…5.4
• CVE-2021-33879Tencent GameLoop before 4.1.21.90 downloaded updates over an…8.1
• CVE-2021-33880The aaugustin websockets library before 9.1 for Python has a…5.9