CVE-2021-31674 is a DOM-based Cross-Site Scripting (XSS) vulnerability affecting Cyclos 4 PRO versions 4.14.7 and earlier. It allows an unauthenticated remote attacker to execute JavaScript code by injecting an undefined enum constant into an error message due to insufficient user input validation. The vulnerability has a CVSSv3.1 score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. While not listed on CISA's KEV catalog and lacking Metasploit or Nuclei modules, an exploit (EDB-50908) is publicly available on ExploitDB. Despite this, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.0.0, <= 4.14.7CPE matchmatch criteria | cpe:2.3:a:cyclos:cyclos:*:*:*:*:pro:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.