CVE-2021-3294

MediumCVSS 5.4

Published: 09/02/2021(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

2.83%

85th percentile - higher than 85% of all known CVEs

Summary

CASAP Automated Enrollment System 1.0 is vulnerable to cross-site scripting (XSS) in users.php. An attacker can steal a user's session cookie and redirect them to a malicious website.

Risk Assessment

The risk involves session hijacking and potential theft of sensitive data, which could compromise the confidentiality and integrity of the system.

Recommendation

Update the system to the latest version and implement input filtering and validation in users.php to prevent script injection.

Original NVD description (English source)

CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php. An attacker can steal a cookie to perform user redirection to a malicious website.