CVE-2021-44598
Last modified
CVE-2021-44598 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Attendance Management System Project | Attendance Management System | 1.0 |
References
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44598Exploit, Third Party Advisory
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44598Exploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-44598?
How severe is CVE-2021-44598?
How do I fix CVE-2021-44598?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-44590In libming 0.4.8, a memory exhaustion vulnerability exist in…6.5
- CVE-2021-44591In libming 0.4.8, the parseSWF_DEFINELOSSLESS2 function in u…6.5
- CVE-2021-44593Simple College Website 1.0 is vulnerable to unauthenticated …8.1
- CVE-2021-44595Wondershare Dr. Fone Latest version as of 2021-12-06 is vuln…8.8
- CVE-2021-44596Wondershare LTD Dr. Fone as of 2021-12-06 version is affecte…9.8
- CVE-2021-44597Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2021-44599The id parameter from Online Enrollment Management System 1.…7.5
- CVE-2021-4460In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2021-44600The password parameter on Simple Online Mens Salon Managemen…7.5
- CVE-2021-44607A Cross Site Scripting (XSS) vulnerability exists in FUEL-CM…5.4
- CVE-2021-44608Multiple Cross Site Scripting (XSS) vulnerabilities exists i…5.4
- CVE-2021-4461Seeyon Zhiyuan OA Web Application System versions up to and …9.3
Are you affected by CVE-2021-44598?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST