CVE-2021-43960

Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator

• CWE-79

• https://www.lorensbergs.co.uk/products/connect2-academic/Product, Vendor Advisory
• https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scriptingExploit, Third Party Advisory
• https://www.lorensbergs.co.uk/products/connect2-academic/Product, Vendor Advisory
• https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scriptingExploit, Third Party Advisory

Published

Jan 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43955The /rest-service-fecru/server-v1 resource in Fisheye and Cr…4.3
• CVE-2021-43956The jQuery deserialize library in Fisheye and Crucible befor…6.1
• CVE-2021-43957Affected versions of Atlassian Fisheye & Crucible allowed re…7.5
• CVE-2021-43958Various rest resources in Fisheye and Crucible before versio…9.8
• CVE-2021-43959Affected versions of Atlassian Jira Service Management Serve…5.7
• CVE-2021-4396The Rucy plugin for WordPress is vulnerable to Cross-Site Re…4.3
• CVE-2021-43961Sonatype Nexus Repository Manager 3.36.0 allows HTML Injecti…4.3
• CVE-2021-43963An issue was discovered in Couchbase Sync Gateway 2.7.0 thro…8.1
• CVE-2021-43969The login.jsp page of Quicklert for Digium 10.0.0 (1043) is …6.5
• CVE-2021-4397The Staff Directory Plugin plugin for WordPress is vulnerabl…4.3
• CVE-2021-43970An arbitrary file upload vulnerability exists in albumimages…8.8
• CVE-2021-43971A SQL injection vulnerability in /mobile/SelectUsers.jsp in …8.8