CVE-2021-3294

CVE-2021-3294 describes a stored Cross-Site Scripting (XSS) vulnerability in the CASAP Automated Enrollment System 1.0, specifically within the users.php component. An authenticated attacker can inject malicious scripts into the "First Name" field, allowing for cookie theft and user redirection to malicious websites. This vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and resulting in low confidentiality and integrity impacts. While there is no evidence of active exploitation, a proof-of-concept exploit is publicly available on ExploitDB, though it has garnered minimal community discussion or media coverage.