{"cve":"CVE-2021-20735","nvd":{"published":"2021-06-22T02:15:07.217","modified":"2026-06-17T03:34:20.557","status":"Modified","description":"Cross-site scripting vulnerability in ETUNA EC-CUBE plugins (Delivery slip number plugin (3.0 series) 1.0.10 and earlier, Delivery slip number csv bulk registration plugin (3.0 series) 1.0.8 and earlier, and Delivery slip number mail plugin (3.0 series) 1.0.8 and earlier) allows remote attackers to inject an arbitrary script by executing a specific operation on the management page of EC-CUBE.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://jvn.jp/en/jp/JVN79254445/index.html","https://www.ec-cube.net/release/detail.php?release_id=5087","https://www.ec-cube.net/release/detail.php?release_id=5088","https://www.ec-cube.net/release/detail.php?release_id=5089","https://jvn.jp/en/jp/JVN79254445/index.html"],"products":["ec-cube:delivery_slip_number","ec-cube:delivery_slip_number_csv_bulk_registration","ec-cube:delivery_slip_number_mail"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-20735","score":0.01121,"percentile":0.66206,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}