CVE-2021-32857 MEDIUM

CVE-2021-32857: Cockpit vulnerable to Cross-site Scripting

Vendor Microweber
Product microweber
Weakness CWE-79 · XSS
Published February 20, 2023
Last update March 10, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Cockpit is a content management system that allows addition of content management functionality to any site. In versions 0.12.2 and prior, bad HTML sanitization in `htmleditor.js` may lead to cross-site scripting (XSS) issues. There are no known patches for this issue.

Key dates

02Disclosure timeline

February 20, 2023 CVE published
March 10, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-28779 WordPress Terms descriptions Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS) CVE-2024-38785 WordPress Gutenverse plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-4567 Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode CVE-2026-25529 Postal has HTML injection / XSS in message view CVE-2024-51676 WordPress Delisho plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability