CVE-2021-36387

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

• CWE-79
• CWE-639

• http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Oct/15Third Party Advisory
• https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
• https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.mdThird Party Advisory
• https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
• https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6Release Notes, Vendor Advisory
• http://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2021/Oct/15Third Party Advisory
• https://cyberaz0r.info/2021/10/yellowfin-multiple-vulnerabilities/
• https://github.com/cyberaz0r/Yellowfin-Multiple-Vulnerabilities/blob/main/README.mdThird Party Advisory
• https://packetstormsecurity.com/files/164515/Yellowfin-Cross-Site-Scripting-Insecure-Direct-Object-Reference.htmlThird Party Advisory, VDB Entry
• https://wiki.yellowfinbi.com/display/yfcurrent/Release+Notes+for+Yellowfin+9#ReleaseNotesforYellowfin9-Yellowfin9.6Release Notes, Vendor Advisory

Published

Oct 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36380Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS…9.8
• CVE-2021-36381In Edifecs Transaction Management through 2021-07-12, an una…5.3
• CVE-2021-36382Devolutions Server before 2021.1.18, and LTS before 2020.3.2…3.7
• CVE-2021-36383Xen Orchestra (with xo-web through 5.80.0 and xo-server thro…4.3
• CVE-2021-36385A SQL Injection vulnerability in Cerner Mobile Care 5.0.0 al…9.8
• CVE-2021-36386report_vbuild in report.c in Fetchmail before 6.4.20 sometim…7.5
• CVE-2021-36388In Yellowfin before 9.6.1 it is possible to enumerate and do…7.5
• CVE-2021-36389In Yellowfin before 9.6.1 it is possible to enumerate and do…7.5
• CVE-2021-3639A flaw was found in mod_auth_mellon where it does not saniti…6.1
• CVE-2021-36392In Moodle, an SQL injection risk was identified in the libra…9.8
• CVE-2021-36393In Moodle, an SQL injection risk was identified in the libra…9.8
• CVE-2021-36394In Moodle, a remote code execution risk was identified in th…9.8