CVE Feed

    Dashboard / CVE / CVE-2021-41236

    CVE-2021-41236

    OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.

    Published:Jan 4, 2022
    Last Modified:Apr 23, 2025
    EPS:Jan 4, 2022
    EPSS Score:0.005
    CVSS Score:6.9

    Affected Products

    Vendor
    Oroinc
    Product
    Oroplatform

    Exploits

    No exploit reference

    Related CVEs

    CVE-2024-50677 (CVSS 6.1) — A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web s…
    CVE-2023-48296 (CVSS 4.3) — OroPlatform is a PHP Business Application Platform (BAP). Navigation history, most viewed and favorite naviga…
    CVE-2023-45824 (CVSS 4.3) — OroPlatform is a PHP Business Application Platform (BAP). A logged in user can access page state data of pinn…
    CVE-2023-32062 (CVSS 5) — OroPlatform is a package that assists system and user calendar management. Back-office users can access inform…
    CVE-2022-41951 (CVSS 8.5) — OroPlatform is a PHP Business Application Platform (BAP) designed to make development of custom business appli…
    CVE-2021-43852 (CVSS 8.8) — OroPlatform is a PHP Business Application Platform. In affected versions by sending a specially crafted reques…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High