{"id":"CVE-2021-35956","aliases":["EUVD-2021-22590","GHSA-fqfc-h72w-f6wm"],"status":"published","title":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480...","description":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0323,"percentile":0.88421,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-79"],"published":"2021-06-30T11:46:22Z","modified":"2026-06-17T03:58:05Z","exploits":[{"source":"exploitdb","id":"EDB-50080","title":"AKCP sensorProbe SPX476 - 'Multiple' Cross-Site Scripting (XSS)","type":"webapps","platform":"hardware","date":"2021-07-02","url":"https://www.exploit-db.com/exploits/50080"},{"source":"pocgithub","id":"tcbutler320/CVE-2021-35956","title":"tcbutler320/CVE-2021-35956","date":"2021-07-01","url":"https://github.com/tcbutler320/CVE-2021-35956"}],"products":[{"vendor":"akcp","product":"sensorprobe2_firmware"},{"vendor":"akcp","product":"sensorprobe4_firmware"},{"vendor":"akcp","product":"sensorprobe8-x20_firmware"},{"vendor":"akcp","product":"sensorprobe8-x60_firmware"},{"vendor":"akcp","product":"sensorprobe8_firmware"}],"references":[{"url":"https://www.akcp.com/support-center/customer-login/sensor-probe-firmware-changelog/","tags":["x_refsource_MISC","x_transferred","Permissions Required","Vendor Advisory"]},{"url":"http://www.akcp.in.th/downloads/Firmwares/SP480-20210624.zip","tags":["x_refsource_MISC","x_transferred","Product","Vendor Advisory"]},{"url":"https://tbutler.org/2021/06/28/cve-2021-35956","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/163343/AKCP-sensorProbe-SPX476-Cross-Site-Scripting.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35956"},{"url":"https://github.com/advisories/GHSA-fqfc-h72w-f6wm"}],"sources":{"cve":[{"id":"CVE-2021-35956","description":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.","status":"published","published":"2021-06-30T11:46:22Z","modified":"2024-08-04T00:47:42.577Z","updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-22590","description":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.","status":"published","published":"2021-06-30T11:46:22Z","modified":"2024-08-04T00:47:42Z","updated_at":"2026-11-03T03:24:29.877227Z"}],"ghsa":[{"id":"GHSA-fqfc-h72w-f6wm","title":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480...","description":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.","status":"published","published":"2022-05-24T19:06:38Z","modified":"2023-01-30T05:00:35Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:46:14.069279Z"}],"nvd":[{"id":"CVE-2021-35956","description":"Stored cross-site scripting (XSS) in the embedded webserver of AKCP sensorProbe before SP480-20210624 enables remote authenticated attackers to introduce arbitrary JavaScript via the Sensor Description, Email (from/to/cc), System Name, and System Location fields.","status":"published","published":"2021-06-30T12:15:07.683Z","modified":"2026-06-17T03:58:05.417Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:55.259633Z"}]}}