CVE-2021-37392

5.4 mediumEPSS 0.5%

Medium (5.4) in rpcms rpcms. EPSS 0.5% chance of exploitation in the next 30 days.

In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. When the API functions are enabled, the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-07-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rpcms:rpcms

References

https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f
https://github.com/ralap-z/RPCMS/
https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f
https://github.com/ralap-z/RPCMS/

Check your stack JSON