Grand Vice info Co. webopac7 - Reflected XSS
Priority LOW 28CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks.
Why it matters now
EPSS 0.0063 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Grand Vice info | webopac7 | 7.1.20160701; 1.8.20160701 | — | No fix listed | CNA |
- webopac7 VendorGrand Vice info Affected 7.1.20160701; 1.8.20160701 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vice:webopac:1.8.20160701:*:*:*:*:*:*:* | 1.8.20160701 | Vulnerable | Grand Vice info |
| cpe:2.3:a:vice:webopac:7.1.20160701:*:*:*:*:*:*:* | 7.1.20160701 | Vulnerable | Grand Vice info |
- cpe:2.3:a:vice:webopac:1.8.20160701:*:*:*:*:*:*:* Versions 1.8.20160701 Vulnerable ·Grand Vice info
- cpe:2.3:a:vice:webopac:7.1.20160701:*:*:*:*:*:*:* Versions 7.1.20160701 Vulnerable ·Grand Vice info
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-42838
- 2026-10-03 Alias added: GHSA-rj3h-j446-4cfq
- 2026-10-28 EPSS moved to the 50th–90th percentile
References
More Grand Vice info Webopac vulnerabilities
- TI-2024-10208 Grand Vice info Webopac - Arbitrary File Upload CVSS 3.1CRITICAL 9.8
- TI-2024-10206 Grand Vice info Webopac - SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-10210 Grand Vice info Webopac7 - SQL Injection CVSS 3.1CRITICAL 9.8
- TI-2024-10207 Grand Vice info Webopac - Arbitrary File Upload CVSS 3.1HIGH 8.8
- TI-2021-19003 Grand Vice info Co. webopac7 - Arbitrary File Upload CVSS 3.1HIGH 8.8
- TI-2024-10209 Grand Vice info Webopac7 - Reflected XSS CVSS 3.1MEDIUM 6.1
Sources
- CVE-2021-42838 · CVE Program
- CVE-2021-42838 · NVD
- FIRST EPSS
- GHSA-rj3h-j446-4cfq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences