CVE-2021-40238

CVE-2021-40238 describes a Cross-Site Scripting (XSS) vulnerability in Webuzo versions prior to 2.9.0. This flaw allows an attacker to inject malicious scripts into the admin panel by crafting an HTTP request to a non-existent page, which then executes when an administrator views the "Error Log." The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and leading to low impact on confidentiality and integrity. While the direct impact is XSS, it can be escalated to unauthenticated Remote Code Execution through the "Cron Jobs" functionality. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit or ExploitDB. The vulnerability has garnered minimal community discussion or media coverage, suggesting a low level of public awareness or concern.