{"cve":"CVE-2021-43960","nvd":{"published":"2022-01-12T19:15:08.453","modified":"2026-06-17T04:11:42.367","status":"Modified","description":"Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title, Page Instructions, Text before, Text after, or Text on side box. Once this has been done, the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application, where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","score":4.8},"cwes":["CWE-79"],"references":["https://www.lorensbergs.co.uk/products/connect2-academic/","https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scripting","https://www.lorensbergs.co.uk/products/connect2-academic/","https://www.surecloud.com/resources/blog/lorensbergs-connect2-cross-site-scripting"],"products":["lorensbergs:connect2"],"source":"nvd","synced_at":"2026-10-19T21:26:33.761856376+00:00"},"epss":{"cve":"CVE-2021-43960","score":0.00592,"percentile":0.48334,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}