CVE-2021-33483

5.4 mediumEPSS 0.6%

Medium (5.4) in onyaktech comments pro project onyaktech comments pro. EPSS 0.6% chance of exploitation in the next 30 days.

An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-09-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

onyaktech_comments_pro_project:onyaktech_comments_pro

References

https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html
https://twitter.com/onyaktech
https://burninatorsec.blogspot.com/2021/07/onyaktech-comments-pro-broken.html
https://twitter.com/onyaktech

Check your stack JSON