← Database

CVE-2021-36387

MEDIUM CVSS: 5.4 Published: 2021-10-14 Modified: 2026-06-17

Description

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

Affected Platforms

Yellowfinbi Yellowfin

Weakness Type

CWE-79, CWE-639

References