← Database

CVE-2021-47725

MEDIUM CVSS: 5.4 Published: 2025-12-31 Modified: 2026-06-17

Description

STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the affected site.

Affected Platforms

Unknown

Weakness Type

CWE-79

References