CVE-2021-47962

5.1 mediumEPSS 0.2%

Medium (5.1). EPSS 0.2% chance of exploitation in the next 30 days.

Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attackers to inject malicious HTML and JavaScript code. Attackers can inject script payloads into user profile fields at the edit_user endpoint, which execute in the browsers of users viewing the affected profile after submission.

Severity

CVSS 4.0

5.1 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

CVSS 3.1

6.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-05-15
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/savsofts/savsoftquiz_v5
https://savsoftquiz.com
https://www.exploit-db.com/exploits/49825
https://www.vulncheck.com/advisories/savsoft-quiz-persistent-cross-site-scripting-via-user-settings

Check your stack JSON