CVE-2021-3841

5.4 mediumEPSS 0.3%

Medium (5.4) in sylius sylius. EPSS 0.3% chance of exploitation in the next 30 days.

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting (XSS) through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2024-11-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

sylius:sylius

References

https://github.com/sylius/sylius/commit/3da169e0c23e752974d74223cc536c29a2a82edc
https://huntr.com/bounties/1625506791178-Sylius/Sylius

Check your stack JSON