CVE-2021-25959

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2021
Source publication: Sep 29, 2021
Source updated: Sep 16, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

OpenCRX - Reflected Cross-Site Scripting in Password Reset Functionality

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

opencrx-core-config

Vendor: org.opencrx
Product: opencrx-core-config
Platforms: Unknown
Default status: Unknown

opencrx-core-config · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
4.0.0	`affected`	custom	*	Unavailable	None listed