CVE-2021-47947
📛 CVE Title
(no title)
Description
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that execute in the browser when the file is viewed by other users, particularly affecting System Administrator users on the Dashboard page.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- medium
- CVSS score
- 6.4 / 10
- CVSS vector
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N- Effective score
- 6.4 / 10 MEDIUM source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2021-47947
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-10 13:16:31 UTC
- NVD last modified
- 2026-05-12 14:47:03 UTC
- NVD CVSS v3.1
- 6.4 / 10 MEDIUM source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N- Exploitability subscore
- 3.1 / 10
- Impact subscore
- 2.7 / 10
- EPSS score
- 0.0003 (probability of exploitation in next 30 days)
- EPSS percentile
- 10.24% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-79
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:04 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2021-34807 - Assigner
- VulnCheck
- Published
- May 10, 2026, 12:44:04 PM
- Updated
- May 24, 2026, 1:37:10 AM
- EUVD base score (CVSS 4.0)
-
5.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - EUVD-reported EPSS
- 0.0300
- Vendors
- projectsend
- Products
-
ProjectSend (r1295)ProjectSend (r1295)
ENISA description: Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edit.php. Attackers can inject JavaScript payloads through the file name field that execute in the browser when the file is viewed by other users, particularly affecting System Administrator users on the Dashboard page.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (7)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2021-47947 tenable:nvd.nist.gov
- https://www.cve.org/CVERecord?id=CVE-2021-47947 tenable:www.cve.org
- https://www.exploit-db.com/exploits/50240 tenable:www.exploit-db.com
- https://www.first.org/epss/ tenable:www.first.org
- https://www.projectsend.org/ tenable:www.projectsend.org
- https://www.projectsend.org/download/387/ tenable:www.projectsend.org
- https://www.vulncheck.com/advisories/projectsend-r1295-stored-cross-site-scripting-via-files-edit-php tenable:www.vulncheck.com
NVD-tagged references (4)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://www.exploit-db.com/exploits/50240 disclosure@vulncheck.com
- https://www.projectsend.org/ disclosure@vulncheck.com
- https://www.projectsend.org/download/387/ disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/projectsend-r1295-stored-cross-site-scripting-via-files-edit-php disclosure@vulncheck.com
Remediations (10)
-
web:cybersecuritynews.com
Microsoft released an out-of-band hotpatch update on March 13, 2026, addressing serious security vulnerabilities in Windows 11 versions 24H2 and 25H2.
2026-05-26 03:07 UTC -
web:github.com
Here's how to use the " fix -0x0000011b.reg" file: Download the [ fix -0x0000011b.reg]. Double-click the downloaded .reg file to apply the changes to your registry. If prompted, confirm the changes and allow the script to make modifications.
2026-05-26 03:07 UTC -
web:learn.microsoft.com
Use the DISM tool to fix problems that prevent Windows Update from installing successfully.
2026-05-26 03:07 UTC -
web:www.digitaltrends.com
Microsoft has released another emergency Windows 11 update after a January patch triggered widespread app crashes, Outlook failures, and cloud sync issues, forcing the company into rare back to ...
2026-05-26 03:07 UTC -
web:www.fda.gov
Risk Evaluation and Mitigation Strategies: Modifications and Revisions Guidance for Industry Additional copies are available from:
2026-05-26 03:07 UTC -
web:www.manageengine.com
2. Deploy Cleanup Patch Search and Deploy the component store cleanup patch 105979 from supported patches list and then redeploy the failed patches. Refer the following Knowledge Base on troubleshooting errors in windows updates. If the issue persists after deploying the CBS patch [105979] and the system is running on a windows 10 or windows 11, upload the agent logs for further analysis ...
2026-05-26 03:07 UTC -
web:www.minitool.com
What are the common causes of DISM error 87? How to fix error 87 when running DISM in Windows 11/10? Find the answers in this post.
2026-05-26 03:07 UTC -
web:www.thewindowsclub.com
Use DISM Tool in Windows 11/10 to fix corrupted Windows Update files using this syntax. If the Windows Update client is already broken, do this.
2026-05-26 03:07 UTC -
web:www.veeam.com
Release Information Below are details about the Cumulative Patches that have been released for Veeam Backup & Replication 12. Each subsequent Cumulative Patch also includes all fixes present in the previous Cumulative Patches.
2026-05-26 03:07 UTC -
web:www.windowscentral.com
Another out of band update has been issued to Windows 11 users to address a major bug that caused Outlook to become inoperable after January's disastrous Patch Tuesday updates.
2026-05-26 03:07 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.