CVE-2021-46387

ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting, which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.

• CWE-79

• http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharingExploit, Third Party Advisory
• https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtmlBroken Link, Vendor Advisory
• https://www.zyxel.com/us/en/support/security_advisories.shtmlVendor Advisory
• http://packetstormsecurity.com/files/166189/Zyxel-ZyWALL-2-Plus-Cross-Site-Scripting.htmlExploit, Third Party Advisory, VDB Entry
• https://drive.google.com/drive/folders/1_XfWBLqxT2Mqt7uB663Sjlc62pE8-rcN?usp=sharingExploit, Third Party Advisory
• https://www.zyxel.com/uk/en/products_services/zywall_2_plus.shtmlBroken Link, Vendor Advisory
• https://www.zyxel.com/us/en/support/security_advisories.shtmlVendor Advisory

Published

Mar 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-46381Local File Inclusion due to path traversal in D-Link DAP-162…7.5
• CVE-2021-46382Unauthenticated cross-site scripting (XSS) in Netgear WAC120…6.1
• CVE-2021-46383https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by:…7.5
• CVE-2021-46384https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by:…9.8
• CVE-2021-46385https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by:…7.5
• CVE-2021-46386File upload vulnerability in mingSoft MCMS through 5.2.5, al…9.8
• CVE-2021-46388Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-46389IIPImage High Resolution Streaming Image Server prior to com…7.5
• CVE-2021-46390An access control issue in the authentication module of Lexa…6.8
• CVE-2021-46393There is a stack buffer overflow vulnerability in the formSe…9.8
• CVE-2021-46394There is a stack buffer overflow vulnerability in the formSe…9.8
• CVE-2021-46398A Cross-Site Request Forgery vulnerability exists in Filebro…8.8