What’s Vulnerable › Vulnerabilities

CVE-2021-30174: RiyaLab Co., Ltd. CloudISO - Stored XSS

• Severity: low (CVSS 3.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-11 · updated 2026-06-17
• Weakness: CWE-79

Description

RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.

Affected products

• RiyaLab Co., Ltd. CloudISO: before 2021.2a — fixed in 2021.2a

How to fix

Upgrade to a fixed version: RiyaLab Co., Ltd. CloudISO 2021.2a. Check the vendor advisory for mitigations.

References

• https://www.twcert.org.tw/tw/cp-132-4718-f16df-1.html
• https://www.twcert.org.tw/tw/cp-132-4718-f16df-1.html

Get alerted when CVE-2021-30174 or the next vulnerability affects your stack