CVE-2021-41169

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.

• CWE-79

• https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445Patch, Third Party Advisory
• https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fxThird Party Advisory
• https://github.com/sulu/sulu/commit/20007ac70a3af3c9e53a6acb0ef8794b65642445Patch, Third Party Advisory
• https://github.com/sulu/sulu/security/advisories/GHSA-h58v-g3q6-q9fxThird Party Advisory

Published

Oct 21, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41163Discourse is an open source platform for community discussio…9.8
• CVE-2021-41164CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41165CKEditor4 is an open source WYSIWYG HTML editor. In affected…5.4
• CVE-2021-41166The Nextcloud Android app is the Android client for Nextclou…5.3
• CVE-2021-41167modern-async is an open source JavaScript tooling library fo…7.5
• CVE-2021-41168Snudown is a reddit-specific fork of the Sundown Markdown pa…6.5
• CVE-2021-4117yetiforcecrm is vulnerable to Business Logic Errors4.3
• CVE-2021-41170neoan3-apps/template is a neoan3 minimal template engine. Ve…9.8
• CVE-2021-41171eLabFTW is an open source electronic lab notebook manager fo…8.8
• CVE-2021-41172AS_Redis is an AntSword plugin for Redis. The Redis Manage p…5.4
• CVE-2021-41173Go Ethereum is the official Golang implementation of the Eth…5.7
• CVE-2021-41174Grafana is an open-source platform for monitoring and observ…6.1