CVE-2021-36450
medium · 6.1A public exploit / detection template exists
Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →
Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
6.1
CVSS
64.3%
EPSS (exploit prob.)
99th
EPSS percentile
2021-12-15
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| verint | workforce_optimization | 15.2.8.10048 |
Check a specific version with /api/v1/cve/match.
References
- https://medium.com/@1nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740
- https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html
- https://medium.com/%401nf0sk/cve-2021-36450-cross-site-scripting-xss-6f5d8d7db740
- https://sushantvkamble.blogspot.com/2021/11/cross-site-scripting-xss.html
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2021-36450