CVE-2021-43677
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Fluxbb version 1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. This allows an attacker to inject malicious JavaScript code into pages viewed by other users.
Risk Assessment
The risk includes potential theft of user sessions, compromise of administrator accounts, or distribution of malware within the forum.
Recommendation
Immediately update Fluxbb to the latest available version that fixes this vulnerability. If an update is not possible, apply temporary mitigations such as input filtering.
Other vulnerabilities in Fluxbb
See all- CVE-2014-9574High
Directory traversal vulnerability in install.php in FluxBB before 1.5.8 allows remote attackers to include and execute arbitrary local install.php files via a .. (dot dot) in the install_lang parameter.
- CVE-2014-10029High
CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.
- CVE-2020-28873High
Fluxbb 1.5.11 is vulnerable to a denial of service (DoS) attack by sending an extremely long password via the login form. The password hashing process exhausts CPU and memory resources on the server.
Original NVD description (English source)
Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS