What’s Vulnerable › Vulnerabilities

CVE-2021-47723: STVS ProVision Cross-Site Request Forgery (Add Admin)

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-09 · updated 2026-06-17
• Weakness: CWE-352

Description

STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.

Affected products

• STVS SA STVS ProVision: 5.5, 5.6, 5.7, 5.8.6, 5.9.0, 5.9.1 (+3)

References

• http://www.stvs.ch
• https://www.exploit-db.com/exploits/49482
• https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin
• https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php

Get alerted when CVE-2021-47723 or the next vulnerability affects your stack