{"id":"CVE-2021-35377","aliases":["EUVD-2021-22020","GHSA-c4jp-6pqw-rc97"],"status":"published","title":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers...","description":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00397,"percentile":0.343,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2023-03-06T00:00:00Z","modified":"2026-07-09T01:16:56Z","products":[{"vendor":"vicidial","product":"vicidial"}],"references":[{"url":"https://www.vicidial.org/VICIDIALforum/viewtopic.php?f=2\u0026t=41634","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35377"},{"url":"http://vicidial.com"},{"url":"https://github.com/advisories/GHSA-c4jp-6pqw-rc97"}],"sources":{"cve":[{"id":"CVE-2021-35377","description":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.","status":"published","published":"2023-03-06T00:00:00Z","modified":"2026-07-09T00:14:03.509Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-22020","description":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.","status":"published","published":"2023-03-06T00:00:00Z","modified":"2026-07-09T00:14:03Z","updated_at":"2026-11-02T18:20:09.112703Z"}],"ghsa":[{"id":"GHSA-c4jp-6pqw-rc97","title":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers...","description":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.","status":"published","published":"2023-03-06T21:30:18Z","modified":"2023-03-21T05:05:12Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:22.471958Z"}],"nvd":[{"id":"CVE-2021-35377","description":"Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidial.php, agc/vicidial-greay.php, and /vicidial/KHOMP_admin.php parameters.","status":"published","published":"2023-03-06T20:15:09.497Z","modified":"2026-07-09T01:16:56.353Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:07.323379Z"}]}}