CVEvulnerability
CVE-2021-37470
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2021-07-25
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
In NCH WebDictate v2.13, persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.
Affected configurations
• nchsoftware webdictate (<= 2.13)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md Exploit, Third Party Advisory
- https://www.nch.com.au/webdictate/index.html Product
- https://github.com/0xfml/poc/blob/main/NCH/WebDictate_2.13_XSS.md Exploit, Third Party Advisory
- https://www.nch.com.au/webdictate/index.html Product