What’s Vulnerable › Vulnerabilities

CVE-2021-28109

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-19 · updated 2026-06-17
• Weakness: CWE-79

Description

TranzWare (POI) FIMI before 4.2.20.4.2 allows login_tw.php reflected Cross-Site Scripting (XSS).

Affected products

• Compassplus Tranzware Fimi: before 4.2.20.4.2 — fixed in 4.2.20.4.2

How to fix

Upgrade to a fixed version: Compassplus Tranzware Fimi 4.2.20.4.2. Check the vendor advisory for mitigations.

References

• https://gist.github.com/ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf
• https://www.tadviser.ru/index.php/%D0%9F%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82:TranzWare_Online
• https://gist.github.com/ArtemBrylev/51106b7cf8929b3ecfb9dd7c9e7b0fcf
• https://www.tadviser.ru/index.php/%D0%9F%D1%80%D0%BE%D0%B4%D1%83%D0%BA%D1%82:TranzWare_Online

Get alerted when CVE-2021-28109 or the next vulnerability affects your stack