CVE-2021-47750
Last modified
CVE-2021-47750 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page. Attackers can craft special signup URLs with embedded script tags to execute arbitrary JavaScript in victims' browsers when they access the signup page.. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page. Attackers can craft special signup URLs with embedded script tags to execute arbitrary JavaScript in victims' browsers when they access the signup page.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Youphptube | Youphptube | <= 7.8 |
References
- https://www.exploit-db.com/exploits/51101Exploit, Third Party Advisory, VDB Entry
- https://www.vulncheck.com/advisories/youphptube-cross-site-scriptingThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2021-47750?
How severe is CVE-2021-47750?
How do I fix CVE-2021-47750?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-47744Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded …9.3
- CVE-2021-47745Cypress Solutions CTM-200 2.7.1 contains an authenticated co…8.8
- CVE-2021-47746NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write v…8.6
- CVE-2021-47747meterN 1.2.3 contains an authenticated remote code execution…8.8
- CVE-2021-47748Hasura GraphQL 1.3.3 contains a remote code execution vulner…9.8
- CVE-2021-47749YouPHPTube <= 7.8 contains a local file inclusion vulnerabil…8.7
- CVE-2021-47751CuteEditor for PHP (now referred to as Rich Text Editor) 6.6…7.5
- CVE-2021-47752AWebServer GhostBuilding 18 contains a denial of service vul…8.7
- CVE-2021-47753phpKF CMS 3.00 Beta y6 contains an unauthenticated file uplo…9.8
- CVE-2021-47754Arunna 1.0.0 contains a cross-site request forgery vulnerabi…6.9
- CVE-2021-47755Oliver Library Server v5 contains a file download vulnerabil…8.7
- CVE-2021-47756Laravel Valet versions 1.1.4 to 2.0.3 contain a local privil…8.4
Are you affected by CVE-2021-47750?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST