CVE-2021-4255

ctrlo lenio contractor.tt cross site scripting

Low3.5EPSS 0.42%

Published: 18 Dec 2022
Updated: 15 Apr 2025
Reserved: 18 Dec 2022
Assigned by: VulDB

Description

A vulnerability was found in ctrlo lenio and classified as problematic. Affected by this issue is some unknown functionality of the file views/contractor.tt. The manipulation of the argument contractor.name leads to cross site scripting. The attack may be launched remotely. The name of the patch is e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216212.

Scores

CVSS scores of CVE-2021-4255, by who scored it
Scored by	CVSS	Score	Vector
VulDBCNA (assigner)	3.1	Low3.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
NVDNVD · Modified	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.42% · top 64% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.

Weakness

CWE-707 Improper Neutralization -> CWE-74 Injection -> CWE-79 Cross Site Scripting (opens in a new tab)All about CWE-707 and its CVEs

Affected products

ctrlo · lenio
- affected n/a

References (2)

https://github.com/ctrlo/lenio/commit/e1646d5cd0a2fbab9eb505196dd2ca1c9e4cdd97 (opens in a new tab)x_transferred
https://vuldb.com/?id.216212 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-4255](https://trackcve.app/badge/CVE-2021-4255.svg)](https://trackcve.app/cve/CVE-2021-4255)

Record last updated 15 Apr 2025, 12:59 UTC.