CVE-2021-37216

6.1 mediumEPSS 3.2%

Medium (6.1) in qsan. EPSS 3.2% chance of exploitation in the next 30 days.

QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 3.2% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-08-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

qsan:xn8008t_firmware
qsan:xn8024r_firmware

References

https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html
https://www.twcert.org.tw/tw/cp-132-4962-44cd2-1.html

Check your stack JSON