CVE-2021-3994
Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting (XSS) - Stored in django-helpdesk/django-helpdesk
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
CVE-2021-3994- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-0056
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
EUVD-2021-0056- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2v5j-q74q-r53f
django-helpdesk is vulnerable to Cross-site Scripting
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- Record
GHSA-2v5j-q74q-r53f- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
CVE-2021-3994- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
CVE-2021-3994- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-2v5j-q74q-r53f
django-helpdesk is vulnerable to Cross-site Scripting
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
- Record
GHSA-2v5j-q74q-r53f- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2021-438 No score
django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Record
PYSEC-2021-438- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
django-helpdeskPyPI |
before 0.3.2 | 0.3.2 |
django-helpdeskPyPI |
before 0.3.2, plus listed versions 0.1.00.1.10.1.100.1.110.1.12 Show 43 moreShow less0.1.130.1.140.1.150.1.160.1.170.1.180.1.20.1.4b0.1.5b0.1.6b0.1.7b0.1.80.2.00.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.170.2.180.2.190.2.20.2.200.2.210.2.220.2.230.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.0b10.3.0b20.3.0b30.3.0b40.3.0b50.3.1 |
0.3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3994 is a high vulnerability (CVSS 8.8) in Django-helpdesk Django-helpdesk/django-helpdesk, published December 1, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in django-helpdesk 0.3.2.
References
huntr.dev/bounties/be7f211d-4bfd-44fd-91e8-682329906fbd
github.com/django-helpdesk/django-helpdesk/commit/a22eb0673fe0b7784f99c6b5fd343b64a6700f06
nvd.nist.gov/vuln/detail/CVE-2021-3994