CVE-2021-41169

MEDIUM

Sulu < 1.6.43 - Authenticated Stored Cross-Site Scripting in Tag Name Input

Title source: llm
STIX 2.1

Description

Sulu is an open-source PHP content management system based on the Symfony framework. In versions before 1.6.43 are subject to stored cross site scripting attacks. HTML input into Tag names is not properly sanitized. Only admin users are allowed to create tags. Users are advised to upgrade.

References (2)

Core 2

Scores

CVSS v3 6.2
EPSS 0.0057
EPSS Percentile 42.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Details

CWE
CWE-79
Status published
Products (2)
sulu/sulu < 1.6.43
sulu/sulu 0 - 1.6.43Packagist
Published Oct 21, 2021
Tracked Since Feb 18, 2026