cve.bz

CVE-2021-25959

6.1 mediumEPSS 0.9%

Medium (6.1) in opencrx opencrx. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in org.opencrx:opencrx-core 5.2.0.

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

Severity

CVSS 3.1

6.1 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-10-31)
CWE
CWE-79
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-rwh9-8xx8-4wfmMavenorg.opencrx:opencrx-core>=4.0.0 <5.2.05.2.0
GHSA-rwh9-8xx8-4wfmMavenorg.opencrx:opencrx-core-models>=4.0.0 <5.2.05.2.0
GHSA-rwh9-8xx8-4wfmMavenorg.opencrx:opencrx-core-config>=4.0.0 <5.2.05.2.0
GHSA-rwh9-8xx8-4wfmMavenorg.opencrx:opencrx-client>=4.0.0 <5.2.05.2.0
GHSA-rwh9-8xx8-4wfmMavenorg.opencrx:opencrx-gradle>=4.0.0 <5.2.05.2.0

References

Check your stackJSON