Read the docs
TI-2021-19659 Aliases CVE-2021-43853GHSA-5q7q-qqw2-hjq7

Cross-Site Scripting in AjaxNetProfessional

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting, Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79 and CWE-502.

Summary

Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details.

Why it matters now

EPSS 0.00851 58th percentileScored 2026-11-07
Fix Fixed Ajax.NET-Professional (michaelschwarz): 21.12.22.1AjaxNetProfessional (NuGet): 21.12.22.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
michaelschwarzAjax.NET-Professionalbefore 21.12.22.121.12.22.1Patch availableCNA
—AjaxNetProfessional (NuGet)before 21.12.22.121.12.22.1Patch availableGHSA-5q7q-qqw2-hjq7
  • Ajax.NET-Professional Vendormichaelschwarz Affected before 21.12.22.1 Fixed in 21.12.22.1 Patch available CNA
  • AjaxNetProfessional (NuGet) Vendor— Affected before 21.12.22.1 Fixed in 21.12.22.1 Patch available GHSA-5q7q-qqw2-hjq7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ajax.net_professional_project:ajax.net_professional:*:*:*:*:*:*:*:*before 21.12.22.1VulnerableAjax.net Professional Project
  • cpe:2.3:a:ajax.net_professional_project:ajax.net_professional:*:*:*:*:*:*:*:* Versions before 21.12.22.1 Vulnerable ·Ajax.net Professional Project

Remediation

  • Fix · CNA Ajax.NET-Professional (michaelschwarz) Fixed in 21.12.22.1
  • Fix · GHSA-5q7q-qqw2-hjq7 AjaxNetProfessional (NuGet) Fixed in 21.12.22.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-43853
  2. 2026-10-03 Alias added: GHSA-5q7q-qqw2-hjq7

References

Patch 1

Advisory 3

Other 1

  • TI-2021-06186 Deserialization of untrusted data in AjaxPro.2 KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-26925 Cross-site Scripting in Ajax.NET Professional CVSS 3.1MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences