CVE-2021-37211 MEDIUM

CVE-2021-37211: Larvata Digital Technology Co. Ltd. FLYGO - Stored XSS

Vendor Larvata Digital Technology Co. Ltd.
Product FLYGO
Weakness CWE-79 · XSS
Published August 9, 2021
Last update September 16, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.

Key dates

02Disclosure timeline

August 9, 2021 CVE published
September 16, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-62990 WordPress Livemesh Addons for Beaver Builder plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability CVE-2024-4526 Campcodes Complete Web-Based School Management System student_payment_details3.php cross site scripting CVE-2026-26272 HomeBox affected by Stored XSS via HTML/SVG Attachment Upload CVE-2023-7225 MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings CVE-2025-40986 Reflected Cross-Site Scripting in PideTuCita