CVE-2021-35377

MediumCVSS 6.1

Published: 06/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.40%

32th percentile - higher than 32% of all known CVEs

Summary

A Cross Site Scripting (XSS) vulnerability was found in VICIdial versions 2.14-610c and 2.10-415c. It allows an attacker to execute arbitrary code via parameters in /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php.

Risk Assessment

An attacker can inject malicious scripts, leading to session hijacking, account takeover, or leakage of sensitive data within the organization.

Recommendation

Immediately update VICIdial to the latest patched version and implement input validation and output encoding for all parameters.

Original NVD description (English source)

Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.