CVE-2021-31930

CVE-2021-31930 describes a persistent cross-site scripting (XSS) vulnerability in Concerto versions up to 2.3.6. An unauthenticated attacker can inject arbitrary JavaScript into the First Name or Last Name fields during user registration. This XSS payload executes when a privileged user attempts to delete the compromised account. Rated as Medium severity (CVSS 6.1), the vulnerability requires user interaction (UI:R) but can be exploited remotely (AV:N) with low attack complexity (AC:L), potentially leading to limited impact on confidentiality and integrity. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE.