CVE-2021-39267

Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via a Content-Type Filter bypass to upload malicious files. This occurs because text/html is blocked, but other types that allow JavaScript execution (such as text/xml) are not blocked.

• CWE-79

• https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19Release Notes, Vendor Advisory
• https://github.com/salesagility/SuiteCRMProduct, Third Party Advisory
• https://thanhlocpanda.wordpress.com/2021/07/31/file-upload-bypass-suitecrm-7-11-18/Exploit, Third Party Advisory
• https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19Release Notes, Vendor Advisory
• https://github.com/salesagility/SuiteCRMProduct, Third Party Advisory
• https://thanhlocpanda.wordpress.com/2021/07/31/file-upload-bypass-suitecrm-7-11-18/Exploit, Third Party Advisory

Published

Aug 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39259A crafted NTFS image can trigger an out-of-bounds access, ca…7.8
• CVE-2021-3926Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMB…
• CVE-2021-39260A crafted NTFS image can cause an out-of-bounds access in nt…7.8
• CVE-2021-39261A crafted NTFS image can cause a heap-based buffer overflow …7.8
• CVE-2021-39262A crafted NTFS image can cause an out-of-bounds access in nt…7.8
• CVE-2021-39263A crafted NTFS image can trigger a heap-based buffer overflo…7.8
• CVE-2021-39268Persistent cross-site scripting (XSS) in the web interface o…6.1
• CVE-2021-3927vim is vulnerable to Heap-based Buffer Overflow7.8
• CVE-2021-39270In Ping Identity RSA SecurID Integration Kit before 3.2, use…7.5
• CVE-2021-39271OrbiTeam BSCW Classic before 7.4.3 allows authenticated remo…8.8
• CVE-2021-39272Fetchmail before 6.4.22 fails to enforce STARTTLS session en…5.9
• CVE-2021-39273In XeroSecurity Sn1per 9.0 (free version), insecure permissi…8.8