CVE-2021-30172 MEDIUM

CVE-2021-30172: Jun-He Technology Ltd. Quan-Fang-Wei-Tong-Xun system - Reflected XSS

Vendor Jun-He Technology Ltd.
Product Quan-Fang-Wei-Tong-Xun system
Weakness CWE-79 · XSS
Published May 7, 2021
Last update September 17, 2024
View on NVD All CVEs

CVSS base score

4.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information.

Key dates

02Disclosure timeline

May 7, 2021 CVE published
September 17, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-3561 GZ Scripts PHP GZ Hotel Booking Script load.php cross site scripting CVE-2025-24620 WordPress AIO Shortcodes plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerability CVE-2025-58654 WordPress xili-language Plugin <= 2.21.3 - Cross Site Scripting (XSS) Vulnerability CVE-2025-23451 WordPress Awesome Twitter Feeds plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2023-25972 WordPress Старт Plugin <= 3.7 is vulnerable to Cross Site Scripting (XSS)