CVE-2021-32853

MEDIUM NUCLEI

erxes < 0.22.3 - Cross-Site Scripting via Widget Renderer

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2021-32853 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.

Nuclei Templates (1)

Erxes <0.23.0 - Cross-Site Scripting
CRITICALby dwisiswant0
Shodan: http.title:"erxes"
FOFA: title="erxes"

References (3)

Core 3

Scores

CVSS v3 6.1
EPSS 0.0312
EPSS Percentile 86.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
erxes/erxes < 0.22.3
npm/erxes 0npm
Published Feb 20, 2023
Tracked Since Feb 18, 2026