CVE-2021-41918

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-10-08 · updated 2026-06-17
Weakness: CWE-79

Description

webTareas version 2.4 and earlier allows an authenticated user to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and achieve a Reflected Cross-Site Scripting attack against the platform users and administrators. The issue affects every endpoint on the application because it is related on how each URL is echoed back on every response page.

Affected products

luiswang WebTareas: through 2.4

References

https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/
https://n4nj0.github.io/advisories/webtareas-multiple-vulnerabilities-i/

Get alerted when CVE-2021-41918 or the next vulnerability affects your stack