Wocu Monitoring stored Cross-Site Scripting (XSS)
Priority LOW 22CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability, the attackers needs an account with enough privileges to view and edit reports.
Why it matters now
EPSS 0.00447 39th percentileScored 2026-11-07
Fix Fixed Wocu Monitoring (A3Sec): 48.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| A3Sec | Wocu Monitoring | 0.27 to before 48.2 | 48.2 | Patch available | CNA |
- Wocu Monitoring VendorA3Sec Affected 0.27 to before 48.2 Fixed in 48.2 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:wocu-monitoring:wocu_monitoring:*:*:*:*:*:*:*:* | 0.27 to before 48.2 | Vulnerable | Wocu-monitoring |
- cpe:2.3:a:wocu-monitoring:wocu_monitoring:*:*:*:*:*:*:*:* Versions 0.27 to before 48.2 Vulnerable ·Wocu-monitoring
Remediation
- Fix · CNA Wocu Monitoring (A3Sec) Fixed in 48.2
Timeline
- 2026-10-02 Threatist record created from CVE-2021-4035
- 2026-10-03 Alias added: GHSA-r342-8mgp-q73j
References
Sources
- CVE-2021-4035 · CVE Program
- CVE-2021-4035 · NVD
- FIRST EPSS
- GHSA-r342-8mgp-q73j · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences