CVE-2021-31674

MediumCVSS 6.1

Published: 02/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.84%

89th percentile - higher than 89% of all known CVEs

Summary

Cyclos 4 PRO version 4.14.7 and earlier does not validate user input in error messages, allowing a remote unauthenticated attacker to execute JavaScript code via an undefined enum constant.

Risk Assessment

An attacker can inject malicious JavaScript, leading to session theft, account takeover, or theft of sensitive data.

Recommendation

Immediately upgrade Cyclos 4 PRO to a version newer than 4.14.7 and implement input validation and encoding in error messages.

Original NVD description (English source)

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant.