CVE-2020-21731

MediumCVSS 6.1

Published: 14/09/2020(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.66%

47th percentile - higher than 47% of all known CVEs

Summary

Cross-Site Scripting (XSS) vulnerability in Gazie 7.29 allows an attacker to inject JavaScript code via the 'user_name' parameter in admin_utente.php. The injected code is stored persistently by the application.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform actions on their behalf, compromising data confidentiality and integrity.

Recommendation

Immediately update Gazie to the latest version and implement input filtering and encoding, especially for the 'user_name' parameter.

Original NVD description (English source)

Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code.