CVE-2021-34817

A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.

• CWE-79

• https://blog.sonarsource.com/etherpad-code-execution-vulnerabilitiesThird Party Advisory
• https://etherpad.org/#downloadPatch, Vendor Advisory
• https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfaExploit, Patch, Third Party Advisory
• https://github.com/ether/etherpad-lite/releases/tag/1.8.14Patch, Release Notes, Third Party Advisory
• https://blog.sonarsource.com/etherpad-code-execution-vulnerabilitiesThird Party Advisory
• https://etherpad.org/#downloadPatch, Vendor Advisory
• https://github.com/ether/etherpad-lite/commit/a7968115581e20ef47a533e030f59f830486bdfaExploit, Patch, Third Party Advisory
• https://github.com/ether/etherpad-lite/releases/tag/1.8.14Patch, Release Notes, Third Party Advisory

Published

Jul 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34811Server-Side Request Forgery (SSRF) vulnerability in task man…4.3
• CVE-2021-34812Use of hard-coded credentials vulnerability in php component…7.5
• CVE-2021-34813Matrix libolm before 3.2.3 allows a malicious Matrix homeser…9.8
• CVE-2021-34814Proofpoint Spam Engine before 8.12.0-2106240000 has a Securi…7.5
• CVE-2021-34815CheckSec Canopy before 3.5.2 allows XSS attacks against the …4.8
• CVE-2021-34816An Argument Injection issue in the plugin management of Ethe…7.2
• CVE-2021-3482A flaw was found in Exiv2 in versions before and including 0…6.5
• CVE-2021-34820Web Path Directory Traversal in the Novus HTTP Server. The N…7.5
• CVE-2021-34821Cross Site Scripting (XSS) vulnerability exists in AAT Novus…6.1
• CVE-2021-34823The ON24 ScreenShare (aka DesktopScreenShare.app) plugin bef…9.1
• CVE-2021-34824Istio (1.8.x, 1.9.0-1.9.5 and 1.10.0-1.10.1) contains a remo…8.8
• CVE-2021-34825Quassel through 0.13.1, when --require-ssl is enabled, launc…7.5