CVE-2021-42940

A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code.

Score

CVSS 3.1 9.9 Critical

Status

Modified - cve@mitre.org

Published

2022-02-11

Last modified

2024-08-04

Weaknesses

CWE-79

Affected products

• Projeqtor (Projeqtor)

References

• https://truedigitalsecurity.com/services/penetration-testing-services/advisory-summary-2.2022-cve-2021-42940
• https://www.projeqtor.org/en/