CVE-2021-26723
MEDIUM NUCLEIJenzabar 9.2.0-9.2.2 - Cross-Site Scripting via Search Query Parameter
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-26723. PoCs published by y0ung_dst. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in Jenzabar versions 9.2.0 through 9.2.2 via the 'query' parameter in the search field. The payload injects a script tag that triggers an alert when executed.
Description
Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.
Exploits (1)
exploitdb
WORKING POC
by y0ung_dst · textwebappsmultiple
https://www.exploit-db.com/exploits/49529
This exploit demonstrates a reflected XSS vulnerability in Jenzabar versions 9.2.0 through 9.2.2 via the 'query' parameter in the search field. The payload injects a script tag that triggers an alert when executed.
Classification
Working Poc 90%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target:
Jenzabar v9.2.0-v9.2.1-v9.2.2
No auth needed
Prerequisites:
A target running Jenzabar 9.2.0 through 9.2.2 · User interaction to click the malicious link
MITRE ATT&CK
devstral-2 · analyzed Feb 18, 2026
Full analysis →
Nuclei Templates (1)
Jenzabar 9.2x-9.2.2 - Cross-Site Scripting
MEDIUMby pikpikcu
References (4)
Core 4
Core References
Vendor Advisory x_refsource_misc
https://jenzabar.com/blog
Exploit, Third Party Advisory x_refsource_misc
https://y0ungdst.medium.com/xss-in-jenzabar-cve-2021-26723-a0749231328
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/161303/Jenzabar-9.2.2-Cross-Site-Scripting.html
Exploit, Third Party Advisory x_refsource_misc
https://gist.github.com/Y0ung-DST/d1b6b65be6248b0ffc2b2f2120deb205
Scores
CVSS v3
6.1
EPSS
0.1095
EPSS Percentile
95.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-79
Status
published
Products (1)
jenzabar/jenzabar
9.2.0 - 9.2.2
Published
Feb 06, 2021
Tracked Since
Feb 18, 2026