CVE-2021-42841

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-06 · updated 2026-06-17
Weakness: CWE-79

Description

Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.

Affected products

Practo Insta Hms: before 12.4.10 — fixed in 12.4.10

How to fix

Upgrade to a fixed version: Practo Insta Hms 12.4.10. Check the vendor advisory for mitigations.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/210416
https://exchange.xforce.ibmcloud.com/vulnerabilities/210416

Get alerted when CVE-2021-42841 or the next vulnerability affects your stack