{"id":"CVE-2021-42329","aliases":["EUVD-2021-29303","GHSA-x6v4-jh5f-25pv"],"status":"published","title":"ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS","description":"The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00586,"percentile":0.48448,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-10-15T12:10:29Z","modified":"2026-06-17T04:09:39Z","products":[{"vendor":"shinher information co., ltd.","product":"shinher studyonline system"},{"vendor":"xinheinformation","product":"xinhe_teaching_platform_system"}],"references":[{"url":"https://www.twcert.org.tw/tw/cp-132-5199-61238-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42329"},{"url":"https://github.com/advisories/GHSA-x6v4-jh5f-25pv"}],"sources":{"cve":[{"id":"CVE-2021-42329","title":"ShinHer Information Co., LTD. ShinHer StudyOnline System - Stored XSS","description":"The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.","status":"published","published":"2021-10-15T12:10:29.738Z","modified":"2024-09-17T00:00:29.574Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:32:58.359368Z"}],"euvd":[{"id":"EUVD-2021-29303","description":"The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.","status":"published","published":"2021-10-15T12:10:29Z","modified":"2024-09-17T00:00:29Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:29:03.409164Z"}],"ghsa":[{"id":"GHSA-x6v4-jh5f-25pv","title":"The “List_Add” function of message board of ShinHer StudyOnline System does not filter special...","description":"The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.","status":"published","published":"2022-05-24T22:33:54Z","modified":"2023-01-30T05:05:51Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:47:22.035472Z"}],"nvd":[{"id":"CVE-2021-42329","description":"The “List_Add” function of message board of ShinHer StudyOnline System does not filter special characters in the title parameter. After logging in with user’s privilege, remote attackers can inject JavaScript and execute stored XSS attacks.","status":"published","published":"2021-10-15T12:15:07.57Z","modified":"2026-06-17T04:09:39.4Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:59.689345Z"}]}}