CVE-2021-25988

MEDIUM

ifme 1.0.0-7.31.4 - Stored Cross-Site Scripting in Notifications Section

Title source: llm
STIX 2.1

Description

In “ifme”, versions 1.0.0 to v7.31.4 are vulnerable against stored XSS vulnerability (notifications section) which can be directly triggered by sending an ally request to the admin.

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.0062
EPSS Percentile 45.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
if-me/ifme 1.0.0 - 7.31.4
Published Dec 29, 2021
Tracked Since Feb 18, 2026