CVEvulnerability

CVE-2021-31930

6.1 MEDIUM Published 2021-05-19 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-05-19
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Persistent cross-site scripting (XSS) in the web interface of Concerto through 2.3.6 allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into the First Name or Last Name parameter upon registration. When a privileged user attempts to delete the account, the XSS payload will be executed.

Affected configurations

• concerto-signage concerto (<= 2.3.6)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References