CVE-2021-47723
STVS ProVision Cross-Site Request Forgery (Add Admin)
- State
- Published
- Severity
- 6.9 Medium
- Published
- Dec 9, 2025
- Updated
- Jul 28, 2026
- Reserved
- Dec 7, 2025
Description
STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-352 Cross-Site Request Forgery (CSRF)
Affected Products
| Product | Versions |
|---|---|
STVS ProVisionSTVS SA |
|
References
- ExploitDB-49482exploit
- STVS SA Homepageproduct
- Zero Science Lab Disclosure (ZSL-2021-5625)third-party-advisory
- VulnCheck Advisory: STVS ProVision Cross-Site Request Forgery (Add Admin)third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.