CVE-2021-27695
MediumCVSS 6.1Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.
Risk Assessment
The risk includes potential session hijacking, data theft, or malware distribution within the organization. Attackers can exploit these vulnerabilities to target administrative staff and other system users.
Recommendation
Immediately update openMAINT to the latest available version that fixes these vulnerabilities. Additionally, implement input validation and output encoding for all form fields.
Original NVD description (English source)
Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Parameters.