CVE-2021-24167

HIGH

web-stat < 1.4.1 - Exposure of Sensitive Information via XMLHttpRequest to External Endpoint

Title source: llm
STIX 2.1

Description

When visiting a site running Web-Stat < 1.4.0, the "wts_web_stat_load_init" function used the visitor’s browser to send an XMLHttpRequest request to https://wts2.one/ajax.htm?action=lookup_WP_account.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0141
EPSS Percentile 69.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (1)
web-stat/web-stat < 1.4.1
Published Apr 05, 2021
Tracked Since Feb 18, 2026