{"id":"CVE-2021-25959","aliases":["GHSA-rwh9-8xx8-4wfm"],"url":"https://o3.security/vulnerability/CVE-2021-25959","summary":"Cross-site Scripting in OpenCRX","details":"In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.","published":"2021-09-29T14:15:07.620Z","modified":"2026-10-20T14:17:24.872842627Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.opencrx:opencrx-core","fixedVersion":"5.2.0"},{"ecosystem":"Maven","name":"org.opencrx:opencrx-core-models","fixedVersion":"5.2.0"},{"ecosystem":"Maven","name":"org.opencrx:opencrx-core-config","fixedVersion":"5.2.0"},{"ecosystem":"Maven","name":"org.opencrx:opencrx-client","fixedVersion":"5.2.0"},{"ecosystem":"Maven","name":"org.opencrx:opencrx-gradle","fixedVersion":"5.2.0"}],"fix":{"url":"https://github.com/opencrx/opencrx/commit/14e75f95e5f56fbe7ee897bdf5d858788072e818","label":"opencrx/opencrx@14e75f9"},"references":[{"type":"WEB","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25959"},{"type":"FIX","url":"https://github.com/opencrx/opencrx/commit/14e75f95e5f56fbe7ee897bdf5d858788072e818"},{"type":"PACKAGE","url":"https://github.com/opencrx/opencrx"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-20T14:17:24.872842627Z"}}