CVE-2021-35956

Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480...

5.4 MediumPublic exploit

Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

3.23%Up 2.1 points since Jul 1, 2021

What each source reports

NVD Score used 5.4

Record: CVE-2021-35956
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-35956
Updated: 2026-11-02

EUVDEUVD-2021-22590 No score

Record: EUVD-2021-22590
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fqfc-h72w-f6wm No score

Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480...

Record: GHSA-fqfc-h72w-f6wm
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)	2021-07-02
PoC in GitHub	tcbutler320/CVE-2021-35956	2021-07-01

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-35956 is a medium vulnerability (CVSS 5.4) in Akcp Sensorprobe2 Firmware, published June 30, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.23%, the 88th percentile. No source names a fixed version.