CVE-2020-21517

MediumCVSS 6.1

Published: 21/06/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.95%

57th percentile - higher than 57% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability was found in MetInfo 7.0.0 via the gourl parameter in login.php. It allows injection of malicious JavaScript code into the login page.

Risk Assessment

An attacker can exploit this flaw to steal user sessions, redirect to malicious sites, or perform other actions in the victim's context, compromising data confidentiality and integrity.

Recommendation

Immediately update MetInfo to the latest version that includes a fix for this vulnerability. If an update is not possible, apply filtering and validation to the gourl parameter.

Original NVD description (English source)

Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.