CVE-2021-47841

Summary

SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute arbitrary code by embedding malicious JavaScript that triggers remote command execution through file or title inputs.

Affected Software

Weaknesses

• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

Additional References

• https://www.vulncheck.com/advisories/snipcommand-persistent-cross-site-scripting

References

• https://www.exploit-db.com/exploits/49829
• https://github.com/gurayyarar/SnipCommand
• https://imgur.com/a/I2reH1M
• https://www.vulncheck.com/advisories/snipcommand-persistent-cross-site-scripting

• ←Previous
• Next→