PT-2025-52828 · Unknown · Orangescrum

Hubert Wojciechowski · Published 2025-12-23 · Updated 2025-12-23 · CVE-2021-47716

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Orangescrum version 1.8.0

Description The application has multiple cross-site scripting issues that permit authenticated attackers to inject malicious scripts through various input parameters. Attackers can exploit parameters such as projid, CS message, and name to execute arbitrary JavaScript code in victim’s browsers by submitting crafted payloads through application endpoints.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47716

Affected Products

Orangescrum

References · 6

• 🔥 https://exploit-db.com/exploits/50554 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47716 · Security Note
• https://osv.dev/vulnerability/CVE-2021-47716 · Vendor Advisory
• https://orangescrum.org · Note
• https://vulncheck.com/advisories/orangescrum-cross-site-scripting-via-authenticated-endpoints · Note
• https://twitter.com/CVEnew/status/2003567280123265345 · Twitter Post