CVE-2021-38707

Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.

• CWE-79

• https://github.com/judsonmitchell/ClinicCases/releasesRelease Notes, Third Party Advisory
• https://github.com/sudonoodle/CVE-2021-38707Exploit, Third Party Advisory
• https://github.com/judsonmitchell/ClinicCases/releasesRelease Notes, Third Party Advisory
• https://github.com/sudonoodle/CVE-2021-38707Exploit, Third Party Advisory

Published

Sep 7, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38701Certain Motorola Solutions Avigilon devices allow XSS in the…4.8
• CVE-2021-38702Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 20…6.1
• CVE-2021-38703Wireless devices running certain Arcadyan-derived firmware (…8.8
• CVE-2021-38704Multiple reflected cross-site scripting (XSS) vulnerabilitie…6.1
• CVE-2021-38705ClinicCases 7.3.3 is affected by Cross-Site Request Forgery …8.8
• CVE-2021-38706messages_load.php in ClinicCases 7.3.3 suffers from a blind …8.8
• CVE-2021-38708In ocProducts Composr CMS before 10.0.38, an attacker can in…5.4
• CVE-2021-38709In ocProducts Composr CMS before 10.0.38, an attacker can in…6.1
• CVE-2021-3871Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-38710Static (Persistent) XSS Vulnerability exists in version 4.3.…6.1
• CVE-2021-38711In gitit before 0.15.0.0, the Export feature can be exploite…7.5
• CVE-2021-38712OneNav 0.9.12 allows Information Disclosure of the onenav.db…7.5