Back to Database
Status published
Medium
CVE-2021-27888
ZendTo before 6.06-4 Beta allows XSS during the display of...
Vulnerability Description
ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-27888
Credits & Attribution
No credits recorded in the NVD database.
References
More from zend
View All →CVE-2020-8986
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly...
Critical
9.8
CVE-2020-8985
ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF...
High
8.8
CVE-2020-8984
lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address...
High
7.5
CVE-2020-29312
An issue found in Zend Framework v.3.1.3 and before allow...
Critical
9.8
CVE-2018-10230
Zend Debugger in Zend Server before 9.1.3 has XSS, aka...
Medium
6.1
Affected Vendor
zend
View all reports →Affected Software
zendto
Vulnerable Versions:
0, 6.06-1, 6.06-2, 6.06-3
Timeline
Official Publish:
March 2nd, 2021
Last Modified:
August 3rd, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.