{"id":"CVE-2021-37502","aliases":["EUVD-2023-0770","GHSA-q3c8-65q7-9v78"],"status":"published","title":"Cross site scripting in automad/automad","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00519,"percentile":0.44554,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-02-03T00:00:00Z","modified":"2026-10-20T10:54:52Z","fixes":[{"ecosystem":"Packagist","package":"automad/automad","fixed_in":["1.8.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"automad/automad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"automad/automad","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0"}]}]}],"products":[{"vendor":"automad","product":"automad"}],"references":[{"url":"https://github.com/marcantondahmen/automad/issues/29","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37502","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-q3c8-65q7-9v78"}],"sources":{"cve":[{"id":"CVE-2021-37502","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","status":"published","published":"2023-02-03T00:00:00Z","modified":"2025-03-26T18:20:51.481Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2023-0770","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","status":"published","published":"2023-02-03T00:00:00Z","modified":"2025-03-26T18:20:51Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:50.922534Z"}],"ghsa":[{"id":"GHSA-q3c8-65q7-9v78","title":"Cross site scripting in automad/automad","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","status":"published","published":"2023-02-03T18:30:26Z","modified":"2024-08-19T20:49:58Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:59.336921Z"}],"nvd":[{"id":"CVE-2021-37502","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","status":"published","published":"2023-02-03T18:15:13.793Z","modified":"2026-06-17T04:00:39.773Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:07.323379Z"}],"osv":[{"id":"CVE-2021-37502","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","status":"published","published":"2023-02-03T18:15:13.793Z","modified":"2026-10-20T10:54:52.396519088Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"GHSA-q3c8-65q7-9v78","title":"Cross site scripting in automad/automad","description":"Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.","status":"published","published":"2023-02-03T18:30:26Z","modified":"2024-08-19T20:49:56Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:54.055966Z"}]}}