CVE-2021-3395

5.4 mediumEPSS 0.8%

A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 55% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-02-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

pryaniki:pryaniki

References

https://github.com/jet-pentest/CVE-2021-3395/
https://pryaniky.com/en/home/
https://github.com/jet-pentest/CVE-2021-3395/
https://pryaniky.com/en/home/

Check your stack JSON