{"id":"CVE-2021-3014","aliases":["EUVD-2021-26367","GHSA-4r5v-83pg-j94v"],"status":"published","title":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS...","description":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00941,"percentile":0.61267,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-01-04T18:38:07Z","modified":"2026-06-17T04:04:33Z","products":[{"vendor":"mikrotik","product":"routeros"}],"references":[{"url":"https://m4dm0e.github.io/2021/01/04/mikrotik-xss-reflected.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2021-01-04-mikrotik-xss-reflected.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3014"},{"url":"https://github.com/advisories/GHSA-4r5v-83pg-j94v"}],"sources":{"cve":[{"id":"CVE-2021-3014","description":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.","status":"published","published":"2021-01-04T18:38:07Z","modified":"2024-08-03T16:45:50.651Z","updated_at":"2026-11-02T14:33:04.360272Z"}],"euvd":[{"id":"EUVD-2021-26367","description":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.","status":"published","published":"2021-01-04T18:38:07Z","modified":"2024-08-03T16:45:50Z","updated_at":"2026-11-03T03:25:14.091701Z"}],"ghsa":[{"id":"GHSA-4r5v-83pg-j94v","title":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS...","description":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.","status":"published","published":"2022-05-24T17:37:58Z","modified":"2024-04-04T03:04:09Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:56:13.24073Z"}],"nvd":[{"id":"CVE-2021-3014","description":"In MikroTik RouterOS through 2021-01-04, the hotspot login page is vulnerable to reflected XSS via the target parameter.","status":"published","published":"2021-01-04T19:15:15.39Z","modified":"2026-06-17T04:04:33.92Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:49.284888Z"}]}}