Description
In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
References (2)
Core 2
Core References
Exploit, Patch, Third Party Advisory x_refsource_misc
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25926%2C
Patch, Third Party Advisory x_refsource_misc
https://github.com/SiCKRAGE/SiCKRAGE/commit/9f42426727e16609ad3d1337f6637588b8ed28e4
Scores
CVSS v3
6.1
EPSS
0.0033
EPSS Percentile
55.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
partial
Details
CWE
CWE-79
Status
published
Products (3)
pypi/sickrage
9.3.54 - 10.0.11.dev2PyPI
sickrage/sickrage
10.0.11 dev1
sickrage/sickrage
9.3.54 - 10.0.11
Published
Apr 12, 2021
Tracked Since
Feb 18, 2026