CVE-2021-47723

STVS ProVision Cross-Site Request Forgery (Add Admin)

Medium6.9Public exploitEPSS 0.20%

Published: 9 Dec 2025
Updated: 28 Jul 2026
Reserved: 7 Dec 2025
Assigned by: VulnCheck

Description

STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting unvalidated HTTP requests. Attackers can visit malicious web sites to trigger the forge request, allowing them to create new admin users.

Public exploit

A reference of the record is tagged as an exploit or proof of concept: anyone can try it against an unpatched system. CISA's SSVC rates its exploitation: a proof of concept is public.

ExploitDB-49482 (opens in a new tab)exploit

Timeline

2025
7 Dec 2025
7 Dec 2025
ID reserved
By VulnCheck
9 Dec 20252 days later
9 Dec 2025· 2 days later
Published
2026
28 Jul 20268 months later
28 Jul 2026· 8 months later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2021-47723, by who scored it
Scored by	CVSS	Score	Vector
VulnCheckCNA (assigner)	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
NVDNVD · Analyzed	4.0	Medium6.9	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS (exploitation in 30 days): 0.20% · top 90% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

CWE-352: Cross-Site Request Forgery (CSRF) (opens in a new tab)All about CWE-352 and its CVEs

Affected products

STVS SA · STVS ProVision
- affected 5.9.10 (build 2885-3a8219a)

References (4)

ExploitDB-49482 (opens in a new tab)exploit
STVS SA Homepage (opens in a new tab)product
Zero Science Lab Disclosure (ZSL-2021-5625) (opens in a new tab)third-party-advisory
VulnCheck Advisory: STVS ProVision Cross-Site Request Forgery (Add Admin) (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2021-47723](https://trackcve.app/badge/CVE-2021-47723.svg)](https://trackcve.app/cve/CVE-2021-47723)

Record last updated 28 Jul 2026, 01:47 UTC.