CVE-2021-47981
📛 CVE Title
(no title)
Description
Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute arbitrary JavaScript in victim browsers when the form is submitted.
Overview
- State
- —
- Assigner (CNA)
- —
- CVSS severity
- medium
- CVSS score
- 5.4 / 10
- CVSS vector
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Effective score
- 5.4 / 10 MEDIUM source: CNA overview
- CWE(s)
- —
- Reserved
- —
- Published
- —
- Last updated
- —
- Source
- https://www.tenable.com/cve/CVE-2021-47981
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- NVD published
- 2026-05-16 16:16:23 UTC
- NVD last modified
- 2026-05-18 17:26:40 UTC
- NVD CVSS v3.1
- 5.4 / 10 MEDIUM source: disclosure@vulncheck.com
- NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N- Exploitability subscore
- 2.3 / 10
- Impact subscore
- 2.7 / 10
- EPSS score
- 0.0003 (probability of exploitation in next 30 days)
- EPSS percentile
- 9.22% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24
NVD-assigned CWE(s):
CWE-79
(differs from the CNA list above)
NVD / KEV / EPSS data refreshed 2026-05-25 00:06 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2021-34836 - Assigner
- VulnCheck
- Published
- May 16, 2026, 3:26:20 PM
- Updated
- May 24, 2026, 1:37:20 AM
- EUVD base score (CVSS 4.0)
-
5.1 / 10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - EUVD-reported EPSS
- 0.0300
- Vendors
- OpenSolution
- Products
-
Quick.CMS (6.7)
- Aliases
-
GHSA-g33h-xxgx-7c28
ENISA description: Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads through the sDescription parameter. Attackers can craft CSRF forms targeting the admin.php?p=sliders-form endpoint to execute arbitrary JavaScript in victim browsers when the form is submitted.
Vendor references (0)
References embedded in the original CVE record by the assigning CNA.
None in the CVE record.
Web references (7)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
- https://nvd.nist.gov/vuln/detail/CVE-2021-47981 tenable:nvd.nist.gov
- https://opensolution.org/ tenable:opensolution.org
- https://opensolution.org/download/home.html?sFile=Quick.Cms_v6.7-en.zip tenable:opensolution.org
- https://www.cve.org/CVERecord?id=CVE-2021-47981 tenable:www.cve.org
- https://www.exploit-db.com/exploits/50530 tenable:www.exploit-db.com
- https://www.first.org/epss/ tenable:www.first.org
- https://www.vulncheck.com/advisories/quick-cms-cross-site-scripting-via-csrf-to-sliders-form tenable:www.vulncheck.com
NVD-tagged references (4)
Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.
- https://opensolution.org/ disclosure@vulncheck.com
- https://opensolution.org/download/home.html?sFile=Quick.Cms_v6.7-en.zip disclosure@vulncheck.com
- https://www.exploit-db.com/exploits/50530 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/quick-cms-cross-site-scripting-via-csrf-to-sliders-form disclosure@vulncheck.com
Remediations (9)
-
web:attack.mitre.org
This mitigation can be implemented through the following measures: Regular Operating System Updates Implementation: Apply the latest Windows security updates monthly using WSUS (Windows Server Update Services) or a similar patch management solution. Configure systems to check for updates automatically and schedule reboots during maintenance ...
2026-05-26 03:07 UTC -
web:feedly.com
Threat Intelligence Report CVE -2025- 47981 is a critical remote code execution vulnerability in the SPNEGO Extended Negotiation (NEGOEX) Security Mechanism, assigned a CVSSv3 score of 9.8, and assessed as "Exploitation More Likely." An unauthenticated remote attacker could exploit this flaw by sending a specially crafted message to vulnerable Windows machines (version 10 version 1607 and above ...
2026-05-26 03:07 UTC -
web:undercodenews.com
Windows Authentication System Exposes Serious Vulnerability Microsoft has rolled out urgent security updates to address a critical flaw in the Windows authentication mechanism that could let attackers remotely execute malicious code. The issue, identified as CVE -2025- 47981 , is a heap-based buffer overflow vulnerability within the SPNEGO Extended Negotiation (NEGOEX) protocol—a crucial ...
2026-05-26 03:07 UTC -
web:windowsforum.com
Repair Windows Update Components with DISM + SFC (Win10/11) to Fix Update Errors Difficulty: Intermediate | Time Required: 20 minutes Windows Update errors often come down to corrupted system files or a damaged component store (the Windows image that updates rely on).
2026-05-26 03:07 UTC -
web:www.howtogeek.com
In this case, use your PC's built-in Windows Update troubleshooter to automatically find and fix issues with your updates. Only a little interaction is required from your end. To run that tool, go to Settings > Update & Security > Troubleshoot > Additional Troubleshooters > Windows Update and click "Run the Troubleshooter".
2026-05-26 03:07 UTC -
web:www.microsoft.com
Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.
2026-05-26 03:07 UTC -
web:www.pcworld.com
Windows 11's Secure Boot fix update finally rolls out to more PCs Important security certificates for Windows 11 will soon expire for many users.
2026-05-26 03:07 UTC -
web:www.tenable.com
Microsoft addresses 128 CVEs in its July 2025 Patch Tuesday release, with 12 rated critical, and 115 rated important and one rated as moderate. Our counts omitted nine vulnerabilities reported by AMD and MITRE.
2026-05-26 03:07 UTC -
web:www.zdnet.com
Install Microsoft's emergency Windows patch now - what it fixes and why it was rushed out Microsoft issued an out-of-band fix after its latest update introduced a nasty surprise.
2026-05-26 03:07 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.