CVE-2021-35440

Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL's for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.

• CWE-79

• https://github.com/Smashing/smashing/blob/ad7325f159f89854ca4e7d94e7be9bee507b6d46/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/Smashing/smashing/pull/186Patch, Third Party Advisory
• https://github.com/Smashing/smashing/pull/186#issuecomment-871727614Patch, Third Party Advisory
• https://github.com/Smashing/smashing/blob/ad7325f159f89854ca4e7d94e7be9bee507b6d46/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/Smashing/smashing/pull/186Patch, Third Party Advisory
• https://github.com/Smashing/smashing/pull/186#issuecomment-871727614Patch, Third Party Advisory

Published

Jul 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35415A stored cross-site scripting (XSS) vulnerability allows att…4.8
• CVE-2021-3542Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-3543A flaw null pointer dereference in the Nitro Enclaves kernel…6.7
• CVE-2021-35437SQL injection vulnerability in LMXCMS v.1.4 allows attacker …9.8
• CVE-2021-35438phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets…6.1
• CVE-2021-3544Several memory leaks were found in the virtio vhost-user GPU…6.5
• CVE-2021-35448Emote Interactive Remote Mouse 3.008 on Windows allows attac…7.8
• CVE-2021-35449The Lexmark Universal Print Driver version 2.15.1.0 and belo…7.8
• CVE-2021-3545An information disclosure vulnerability was found in the vir…6.5
• CVE-2021-35450A Server Side Template Injection in the Entando Admin Consol…7.2
• CVE-2021-35451In Teradici PCoIP Management Console-Enterprise 20.07.0, an …6.1
• CVE-2021-35452An Incorrect Access Control vulnerability exists in libde265…6.5