CVE-2021-30171 MEDIUM

CVE-2021-30171: Jun-He Technology Ltd. ERP POS - Stored XSS-2

Vendor Jun-He Technology Ltd.
Product ERP POS
Weakness CWE-79 · XSS
Published May 7, 2021
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.

Key dates

02Disclosure timeline

May 7, 2021 CVE published
September 17, 2024 Record updated