CVE-2021-25993

    Dashboard / Vulnerabilities / CVE-2021-25993

    CVE-2021-25993

    Published: 29 Dec 2021Last Modified: 8 Jul 2026

    Summary:

    Details: In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.

    References: https://github.com/Requarks/wiki/commit/5d3e81496fba1f0fbd64eeb855f30f69a9040718, https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25993

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- b5d773caecaad2cc592f6a399dbc6c965d5d855b
    Fixed -None

    Affected versions

    2.5.255
    2.5.254
    2.5.219
    2.5.214
    2.5.201
    2.5.197
    2.5.191
    2.5.170
    2.5.159
    2.5.144
    2.5.136
    2.5.132
    2.5.126
    2.5.121
    2.5.117
    2.5.105

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-25993 | CVE-DB