CVE-2021-37504

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

• CWE-79

• http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.jsThird Party Advisory
• http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.jsThird Party Advisory
• http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.cssThird Party Advisory
• https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469Third Party Advisory
• https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.jsThird Party Advisory
• http://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.jsThird Party Advisory
• http://hayageek.github.io/jQuery-Upload-File/4.0.11/jquery.uploadfile.min.jsThird Party Advisory
• http://hayageek.github.io/jQuery-Upload-File/4.0.11/uploadfile.cssThird Party Advisory
• https://github.com/hayageek/jquery-upload-file/blob/master/js/jquery.uploadfile.js#L469Third Party Advisory
• https://raw.githubusercontent.com/hayageek/jquery-upload-file/master/js/jquery.uploadfile.jsThird Party Advisory

Published

Feb 25, 2022

Last Modified

Jul 9, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37498An SSRF issue was discovered in Reprise License Manager (RLM…6.5
• CVE-2021-37499CRLF vulnerability in Reprise License Manager (RLM) web inte…6.5
• CVE-2021-3750A DMA reentrancy issue was found in the USB EHCI controller …8.2
• CVE-2021-37500Directory traversal vulnerability in Reprise License Manager…8.1
• CVE-2021-37501Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0…7.5
• CVE-2021-37502Cross Site Scripting (XSS) vulnerability in automad 1.7.5 al…5.4
• CVE-2021-3751libmobi is vulnerable to Out-of-bounds Write9.8
• CVE-2021-37517An Access Control vulnerability exists in Dolibarr ERP/CRM 1…7.5
• CVE-2021-37518Universal Cross Site Scripting (UXSS) vulnerability in Vimiu…6.1
• CVE-2021-37519Buffer Overflow vulnerability in authfile.c memcached 1.6.9 …5.5
• CVE-2021-3752A use-after-free flaw was found in the Linux kernel’s Blueto…7.1
• CVE-2021-37522SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 all…9.8