Back to Database
Status published
Medium
CVE-2021-32853
Erxes vulnerable to Cross-site Scripting
Vulnerability Description
Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32853
Credits & Attribution
No credits recorded in the NVD database.
References
More from npm
View All →CVE-2023-31999
All versions of @fastify/oauth2 used a statically generated state parameter...
Unknown
0
CVE-2022-29244
npm packing does not respect root-level ignore files in workspaces
Unknown
0
CVE-2021-39135
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
High
8.2
CVE-2021-39134
UNIX Symbolic Link (Symlink) Following in @npmcli/arborist
High
8.2
CVE-2021-37713
Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
High
8.2
Affected Vendor
Affected Software
erxes
Vulnerable Versions:
0.22.3
Timeline
Official Publish:
February 20th, 2023
Last Modified:
March 10th, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N