What’s Vulnerable › Vulnerabilities

CVE-2021-3693: Cross-site Scripting (XSS) - DOM in ledgersmb/ledgersmb

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-23 · updated 2026-06-17
• Weakness: CWE-79

Description

LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user, this flaw can be abused for remote code execution and information disclosure.

Affected products

• Debian Linux: 10.0, 11.0
• ledgersmb/ledgersmb: from 1.5.0 through 1.5.30; from 1.6.0 through 1.6.33; from 1.7.0 through 1.7.32; from 1.8.0 through 1.8.17

References

• https://huntr.dev/bounties/daf1384d-648a-43fd-9b35-5c37d8ead667
• https://ledgersmb.org/cve-2021-3693-cross-site-scripting
• https://www.debian.org/security/2021/dsa-4962
• https://huntr.dev/bounties/daf1384d-648a-43fd-9b35-5c37d8ead667
• https://ledgersmb.org/cve-2021-3693-cross-site-scripting
• https://www.debian.org/security/2021/dsa-4962

Get alerted when CVE-2021-3693 or the next vulnerability affects your stack