CVE-2021-40191

Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and return a wrong response in content-type of output data in webroot/dzz/attach/controller.php.

Score

CVSS 3.1 5.4 Medium

Status

Modified - cve@mitre.org

Published

2021-10-11

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Dzzoffice (Dzzoffice)

References

• https://github.com/zyx0814/dzzoffice/issues/196