CVE-2021-39402

CVE-2021-39402 describes a code injection vulnerability in MaianAffiliate v.1.0, allowing an authenticated administrator to inject malicious code when adding a new product. This injected payload is then reflected on the affiliate main page, impacting all visitors. With a CVSS score of 7.2 (High), this vulnerability poses a significant risk due to its low attack complexity and high potential for confidentiality, integrity, and availability compromise. While the vulnerability is not listed on the KEV catalog and lacks public exploit code or significant community discussion, its ease of exploitation by an authenticated attacker makes it a notable concern for affected systems.