Riskcovery

CVE-2021-25983

FactorJS - Reflected Cross-Site Scripting (XSS) in Tags and Categories Functionality

State
Published
Severity
6.1 Medium
Published
Nov 16, 2021
Updated
Apr 30, 2025
Reserved
Jan 22, 2021

Read the record on cve.org

Description

In Factor (App Framework & Headless CMS) forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting (XSS) at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies.

Scores

CVSSScoreVectorSource
3.16.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NMend

Weaknesses

  • CWE-79 Cross-site Scripting (XSS)

Affected Products

ProductVersions
FactorFactorJS
  • 1.3.8 to before unspecifiedAffected
  • 1.8.30 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.