CVE-2021-47723

6.9 mediumEPSS 0.2%

Medium (6.9) in stvs provision. EPSS 0.2% chance of exploitation in the next 30 days.

STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
CWE: CWE-352
Published: 2025-12-09
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

stvs:provision

References

http://www.stvs.ch
https://www.exploit-db.com/exploits/49482
https://www.vulncheck.com/advisories/stvs-provision-cross-site-request-forgery-add-admin
https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5625.php

Check your stack JSON