CVE-2021-47725

EUVD-2025-206078
STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the affected site.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
stvsprovision
5.9.10
CNA
stvsprovision
5.9.9
CNA
stvsprovision
5.9.7
CNA
stvsprovision
5.9.1
CNA
stvsprovision
5.9.0
CNA
stvsprovision
5.8.6
CNA
stvsprovision
5.7
CNA
stvsprovision
5.6
CNA
stvsprovision
5.5
CNA
Common Weakness Enumeration
References
https://cxsecurity.com/issue/WLB-2021010188
https://exchange.xforce.ibmcloud.com/vulnerabilities/195723
https://packetstormsecurity.com/files/161158/STVS-ProVision-5.9.10-Cross-Site-Scripting.html
https://stvs.com/
https://www.vulncheck.com/advisories/stvs-provision-authenticated-reflected-cross-site-scripting-via-files-parameter
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5624.php