CVE Catalog
CVE-2021-31721
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk0.89%
55th percentile - higher than 55% of all known CVEs
Summary
An XSS vulnerability in Chevereto before version 3.17.1 allows an attacker to inject malicious script via the image title during file upload.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other unauthorized actions in the victim's browser context.
Recommendation
Immediately update Chevereto to version 3.17.1 or later, which includes a fix for the XSS vulnerability.
Original NVD description (English source)
Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.