CVE-2021-41132

OMERO.web provides a web based client and plugin infrastructure. In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of cross-site scripting possibilities with specially crafted input to a variety of fields. This issue is patched in version 5.11.0. There are no known workarounds aside from upgrading.

• CWE-116
• CWE-79

• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424Patch, Third Party Advisory
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvfThird Party Advisory
• https://www.openmicroscopy.org/security/advisories/2021-SV3/Vendor Advisory
• https://github.com/ome/omero-web/commit/0168067accde5e635341b3c714b1d53ae92ba424Patch, Third Party Advisory
• https://github.com/ome/omero-web/security/advisories/GHSA-g67g-hvc3-xmvfThird Party Advisory
• https://www.openmicroscopy.org/security/advisories/2021-SV3/Vendor Advisory

Published

Oct 14, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41127Rasa is an open source machine learning framework to automat…7.1
• CVE-2021-41128Hygeia is an application for collecting and processing perso…8.8
• CVE-2021-41129Pterodactyl is an open-source game server management panel b…8.1
• CVE-2021-4113Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-41130Extensible Service Proxy, a.k.a. ESP is a proxy which enable…5.4
• CVE-2021-41131python-tuf is a Python reference implementation of The Updat…8.7
• CVE-2021-41133Flatpak is a system for building, distributing, and running …7.8
• CVE-2021-41134nbdime provides tools for diffing and merging of Jupyter Not…5.4
• CVE-2021-41135The Cosmos-SDK is a framework for building blockchain applic…6.5
• CVE-2021-41136Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior …3.7
• CVE-2021-41137Minio is a Kubernetes native application for cloud storage. …8.8
• CVE-2021-41138Frontier is Substrate's Ethereum compatibility layer. In the…5.3