CVE-2021-37788

A vulnerability in the web UI of Gurock TestRail v5.3.0.3603 could allow an unauthenticated, remote attacker to affect the integrity of a device via a clickjacking attack. The vulnerability is due to insufficient input validation of iFrame data in HTTP requests that are sent to an affected device. An attacker could exploit this vulnerability by sending crafted HTTP packets with malicious iFrame data. A successful exploit could allow the attacker to perform a clickjacking attack where the user is tricked into clicking a malicious link.

• CWE-1021

• https://gist.github.com/rvismit/67bc11dd9ccb7423827564cb81d25740Exploit, Third Party Advisory
• https://gist.github.com/rvismit/67bc11dd9ccb7423827564cb81d25740Exploit, Third Party Advisory

Published

Aug 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37778There is a buffer overflow in gps-sdr-sim v1.0 when parsing …9.8
• CVE-2021-3778vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-37781Employee Record Management System v 1.2 is vulnerable to Cro…5.4
• CVE-2021-37782Employee Record Management System v 1.2 is vulnerable to SQL…9.8
• CVE-2021-37786Certain Federal Office of Information Technology Systems and…4.6
• CVE-2021-37787The unprivileged administrative interface in ABO.CMS version…6.5
• CVE-2021-37789stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_…8.1
• CVE-2021-3779A malicious MySQL server can request local file content from…6.5
• CVE-2021-37791MyAdmin v1.0 is affected by an incorrect access control vuln…4.9
• CVE-2021-37794A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2021-3780peertube is vulnerable to Improper Neutralization of Input D…6.1
• CVE-2021-37803An SQL Injection vulnerability exists in Sourcecodester Onli…8.1