{"cve":"CVE-2021-21043","nvd":{"published":"2021-02-02T23:15:12.813","modified":"2026-06-17T03:34:43.137","status":"Modified","description":"ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-f92j-qf46-p6vm","https://github.com/Adobe-Consulting-Services/acs-aem-commons/security/advisories/GHSA-f92j-qf46-p6vm"],"products":["adobe:adobe_consulting_services_commons"],"source":"nvd","synced_at":"2026-10-19T21:14:10.479542811+00:00"},"epss":{"cve":"CVE-2021-21043","score":0.03378,"percentile":0.88775,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-7r83-w6r8-fh6w","url":"https://osv.dev/vulnerability/GHSA-7r83-w6r8-fh6w","summary":"Reflected Cross-site Scripting (XSS) in ACS Commons","modified":"2026-07-08T06:49:39.794736160Z","packages":[{"ecosystem":"Maven","name":"com.adobe.acs:acs-aem-commons","purl":"pkg:maven/com.adobe.acs/acs-aem-commons","ranges":["<4.10.0"],"fixed":["4.10.0"]}]},{"id":"GHSA-f92j-qf46-p6vm","url":"https://osv.dev/vulnerability/GHSA-f92j-qf46-p6vm","summary":"Reflected Cross-site Scripting in ACS Commons","modified":"2026-07-08T06:49:39.794736160Z","packages":[{"ecosystem":"Maven","name":"com.adobe.acs:acs-aem-commons","purl":"pkg:maven/com.adobe.acs/acs-aem-commons","ranges":["<4.10.0"],"fixed":["4.10.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}