CVE-2021-38707

CVE-2021-38707 describes persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3, allowing low-privileged attackers to inject malicious JavaScript into account parameters. This medium-severity vulnerability (CVSS 5.4) can lead to account takeover through session token theft, as the XSS payloads execute when other users view the compromised content. While the attack complexity is low, user interaction is required, and the impact is limited to confidentiality and integrity. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.