Medium severity · published Jul 23, 2021
CVE-2021-25790
Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary…
5.4
CVSS
0.9%
EPSS
No
On KEV
Description
Multiple stored cross site scripting (XSS) vulnerabilities in the "Register" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
HR
House Rental And Property Listing Php
House Rental And Property Listing Php Project
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-25790
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-25790
Exploit
https://www.exploit-db.com/exploits/49352
Product
https://www.sourcecodester.com
Product
https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html
More from House Rental And Property Listing Php
9.8
CVE-2023-3806
SourceCodester House Rental and Property Listing System btn_functions.php unrestricted upload