Flygo
CVE-2021-37211
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks.
AnalysisAI
The bulletin function of Flygo does not filter special characters while a new announcement is added. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks. Affected products include: Larvata Flygo.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.
The employee management page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. Rated high severit
The bulletin function of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. Rated medium severity (CV
The employee management page of Flygo contains an Insecure Direct Object Reference (IDOR) vulnerability. Rated medium se
The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. Rated medium severity
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today