{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-22T16:14:40.681","vulnerabilities":[{"cve":{"id":"CVE-2021-37393","sourceIdentifier":"cve@mitre.org","published":"2021-07-26T18:15:08.550","lastModified":"2026-06-17T04:00:27.990","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In RPCMS v1.8 and below, the \"nickname\" variable is not properly sanitized before being displayed on page. Attacker can use \"update password\" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS."},{"lang":"es","value":"En RPCMS versiones v1.8 y por debajo, la variable \"nickname\" no se sanea apropiadamente ntes de ser mostrada en la página. El atacante puede usar la función \"update password\" para inyectar cargas útiles de tipo XSS en la variable \"nickname\" y lograr un ataque de tipo XSS almacenado. Unos usuarios que vean los artículos publicados por el usuario inyectado activarán el ataque de tipo XSS"}],"affected":[{"source":"cve@mitre.org","affectedData":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.3,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rpcms:rpcms:*:*:*:*:*:*:*:*","versionEndIncluding":"1.8","matchCriteriaId":"5755310D-B470-4257-9169-DC1AC3180438"}]}]}],"references":[{"url":"https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f","source":"cve@mitre.org","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/ralap-z/RPCMS/","source":"cve@mitre.org","tags":["Product"]},{"url":"https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/ralap-z/RPCMS/","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"]}]}}]}