PT-2025-54419 · Unknown · Stvs Provision

Published 2025-12-31 · Updated 2025-12-31 · CVE-2021-47725

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions STVS ProVision version 5.9.10

Description The software contains a cross-site scripting issue in the 'files' POST parameter. Authenticated attackers can inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the affected site. The vulnerable parameter is files.

Recommendations Apply input validation and sanitization to the files POST parameter to prevent the injection of malicious HTML code.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47725

Affected Products

Stvs Provision

References · 8

• 🔥 https://packetstormsecurity.com/files/161158/STVS-ProVision-5.9.10-Cross-Site-Scripting.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47725 · Security Note
• https://stvs.com · Note
• https://vulncheck.com/advisories/stvs-provision-authenticated-reflected-cross-site-scripting-via-files-parameter · Note
• https://twitter.com/CVEnew/status/2006495385309561042 · Twitter Post
• https://zeroscience.mk/en/vulnerabilities/ZSL-2021-5624.php · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/195723 · Note
• https://cxsecurity.com/issue/WLB-2021010188 · Note