CVE-2021-47931
MEDIUMExponent CMS 2.6 Text Editing Endpoint - Stored Cross-Site Scripting
Title source: manualExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47931. PoCs published by heinjame.
AI-analyzed exploit summary The exploit demonstrates multiple vulnerabilities in Exponent CMS 2.6, including stored XSS, database credential disclosure, and authentication brute-forcing. It includes functional code for brute-forcing usernames and passwords, as well as a payload for XSS.
Description
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.
Exploits (1)
The exploit demonstrates multiple vulnerabilities in Exponent CMS 2.6, including stored XSS, database credential disclosure, and authentication brute-forcing. It includes functional code for brute-forcing usernames and passwords, as well as a payload for XSS.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N