CVE-2021-31673

MediumCVSS 6.1

Published: 02/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.49%

83th percentile - higher than 83% of all known CVEs

Summary

A DOM-based Cross-site Scripting (XSS) vulnerability in the account registration process in Cyclos 4 PRO version 14.7 and earlier. A remote attacker can inject arbitrary web script or HTML via the groupId parameter.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other actions in their context, leading to data confidentiality and integrity breaches.

Recommendation

Immediately upgrade Cyclos 4 PRO to a version later than 14.7, which includes a fix for this vulnerability.

Original NVD description (English source)

A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter.