CVE-2021-40238

A Cross Site Scriptiong (XSS) vulnerability exists in the admin panel in Webuzo < 2.9.0 via an HTTP request to a non-existent page, which is activated by administrators viewing the "Error Log" page. An attacker can leverage this to achieve Unauthenticated Remote Code Execution via the "Cron Jobs" functionality of Webuzo.

• CWE-79

• https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8eThird Party Advisory
• https://www.webuzo.com/blog/webuzo-2-9-0-launched/Release Notes, Vendor Advisory
• https://gist.github.com/omriinbar/5a24ccc2127ac61b6d9872c9405ebc8eThird Party Advisory
• https://www.webuzo.com/blog/webuzo-2-9-0-launched/Release Notes, Vendor Advisory

Published

Sep 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40219Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsa…8.8
• CVE-2021-4022A vulnerability was found in rizin. The bug involves an ELF6…5.5
• CVE-2021-40222Rittal CMC PU III Web management Version affected: V3.11.00_…7.2
• CVE-2021-40223Rittal CMC PU III Web management (version V3.11.00_2) fails …5.4
• CVE-2021-40226xpdfreader 4.03 is vulnerable to Buffer Overflow.7.5
• CVE-2021-4023A flaw was found in the io-workqueue implementation in the L…5.5
• CVE-2021-40239A Buffer Overflow vulnerability exists in the latest version…9.8
• CVE-2021-4024A flaw was found in podman. The `podman machine` function (u…6.5
• CVE-2021-40241xfig 3.2.7 is vulnerable to Buffer Overflow.9.8
• CVE-2021-40247SQL injection vulnerability in Sourcecodester Budget and Exp…9.8
• CVE-2021-4026bookstack is vulnerable to Improper Access Control4.3
• CVE-2021-40260Multiple Cross Site Scripting (XSS) vulnerabilities exist in…6.1