{"id":"CVE-2021-44970","aliases":["CLSA-2021-1640697114","EUVD-2021-31768","GHSA-4w2g-r9pq-p6qg"],"status":"published","title":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin...","description":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00487,"percentile":0.42263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2021-12-28T13:11:54Z","modified":"2026-10-20T10:55:07Z","affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-suexec-custom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-suexec-pristine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"apache2-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els3"}]}],"bundled":2}],"products":[{"vendor":"1234n","product":"minicms"}],"references":[{"url":"https://github.com/bg5sbk/MiniCMS/issues/43","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44970"},{"url":"https://github.com/advisories/GHSA-4w2g-r9pq-p6qg"},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2021-1640697114","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-44970","description":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.","status":"published","published":"2022-02-10T22:39:11Z","modified":"2024-08-04T04:32:13.47Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-31768","description":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.","status":"published","published":"2022-02-10T22:39:11Z","modified":"2024-08-04T04:32:13Z","updated_at":"2026-11-03T03:08:28.023592Z"}],"ghsa":[{"id":"GHSA-4w2g-r9pq-p6qg","title":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin...","description":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.","status":"published","published":"2022-02-12T00:00:51Z","modified":"2023-02-03T05:06:02Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:53:49.735091Z"}],"nvd":[{"id":"CVE-2021-44970","description":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.","status":"published","published":"2022-02-10T23:15:07.997Z","modified":"2026-06-17T04:13:01.087Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"CVE-2021-44970","description":"MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.","status":"published","published":"2022-02-10T23:15:07.997Z","modified":"2026-10-20T10:55:07.180244429Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:21.877444Z"},{"id":"CLSA-2021-1640697114","title":"Fix CVE(s): CVE-2021-44224, CVE-2021-44970","description":"\n   * SECURITY UPDATE: buffer overflow in the mod_lua multipart parser\n     - debian/patches/CVE-2021-44970.patch: add test to prevent integer overflow in req_parsebody()\n     - CVE-2021-44970\n   * SECURITY UPDATE: null pointer dereference in reverse proxy module\n     - debian/patches/CVE-2021-44224.patch: add tests for return value of ap_proxy_de_socketfy()\n     - CVE-2021-44224","status":"published","published":"2021-12-28T13:11:54Z","modified":"2026-06-04T10:03:30.1132Z","updated_at":"2026-11-02T15:43:39.801198Z"}]}}