CVE-2021-35377

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-03-06 · updated 2026-07-09
Weakness: CWE-79

Description

Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.

Affected products

VICIdial: 2.9-401c-140612-1626, 2.10-415c-140918-1606, 2.14-597c-191114-0949, 2.14-610c-200528-2239

References

https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=2&t=41634
https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=2&t=41634

Get alerted when CVE-2021-35377 or the next vulnerability affects your stack