CVE-2021-38488

medium · 5.5

Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to cross-site scripting because an authenticated attacker can inject arbitrary JavaScript code into the parameter comment of the API events, which may allow an attacker to remotely execute code.

5.5

CVSS

12.3%

EPSS (exploit prob.)

96th

EPSS percentile

2021-11-03

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
deltaww	dialink	<= 1.2.4.0

Check a specific version with /api/v1/cve/match.

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02
https://us-cert.cisa.gov/ics/advisories/icsa-21-294-02

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2021-38488