PT-2026-39501 · Cmdbuild · Cmdbuild

Hosein Vita · Published 2026-05-10 · Updated 2026-05-10 · CVE-2021-47925

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions CMDBuild version 3.3.2

Description Authenticated attackers can inject arbitrary HTML or web scripts through crafted input. This occurs via the card creation and file upload endpoints, specifically through Employee card parameters or SVG file attachments in the classes endpoint. The injected scripts execute when other users view the affected records or preview the attachments. Stored cross-site scripting (XSS) is a flaw where a malicious script is permanently stored on the target server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-47925

Affected Products

Cmdbuild

References · 6

• 🔥 https://exploit-db.com/exploits/50527 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-47925 · Security Note
• https://cmdbuild.org/en/download/latest-version · Note
• https://twitter.com/CVEnew/status/2053537439801852277 · Twitter Post
• https://vulncheck.com/advisories/cmdbuild-multiple-stored-cross-site-scripting · Note
• https://cmdbuild.org · Note