TI-2021-12518 CVE-2021-32853 · GHSA-g9ph-r9hc-34r8
Erxes vulnerable to Cross-site Scripting
Priority HIGH 74
Erxes, an experience operating system (XOS) with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior.
Erxes
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Erxes records in CISA KEVNo Erxes vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records in Erxes · all components
TI-2024-37819 CVE-2024-57190 · GHSA-7rhv-xm4q-wh42
Erxes <1.6.1 is vulnerable to Incorrect Access Control.
Priority MEDIUM 50
Erxes <1.6.1 is vulnerable to Incorrect Access Control.
TI-2024-37818 CVE-2024-57189 · GHSA-2977-5php-6789
In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system…
Priority LOW 25
In Erxes <1.6.2, an authenticated attacker can write to arbitrary files on the system using a Path Traversal vulnerability in the importHistoriesCreate GraphQL mutation handler.
TI-2024-37817 CVE-2024-57186 · GHSA-rq9r-qvwg-829q
In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system…
Priority LOW 25
In Erxes <1.6.2, an unauthenticated attacker can read arbitrary files from the system using a Path Traversal vulnerability in the /read-file endpoint handler.