CVE-2021-26628

MaxBoard XSS and File Upload Vulnerability

State: Published
Severity: 8.1 High
Published: Apr 26, 2022
Updated: Aug 3, 2024
Reserved: Feb 3, 2021

Description

Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N	krcert

Weaknesses

CWE-79 Cross-site Scripting (XSS)
CWE-434 Unrestricted Upload of File with Dangerous Type

Affected Products

Product	Versions
MaxBoardNo Vendor Information	1.9.6 and earlierAffected

References

https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66673

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.