CVE-2021-41565

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.

Score

CVSS 3.1 6.1 Medium

Status

Modified - twcert@cert.org.tw

Published

2021-10-08

Last modified

2024-09-16

Weaknesses

CWE-79

Affected products

• Tadtools (Tad)
• Tadtools (Tadtools Project)

References

• https://www.twcert.org.tw/tw/cp-132-5169-327ef-1.html