CVE-2021-47925 - CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting

Back Back to CVE browser

MEDIUM

CMDBuild 3.3.2 Multiple Stored Cross-Site Scripting

Published May 10, 2026

5.1

MEDIUM

CVSS 4.0

EPSS 0.24%

Description

CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file attachments in the classes endpoint, which execute when other users view the affected records or preview attachments.

Affected products

Vendor Cmdbuild Product CMDBuild Default
n/a
- Version
  CMDBuild 3.3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cmdbuild

CMDBuild

n/a

Version	Status	Constraints
CMDBuild 3.3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (4)

https://www.cmdbuild.org
product
https://www.cmdbuild.org/en/download/latest-version
product
https://www.exploit-db.com/exploits/50527
exploit
https://www.vulncheck.com/advisories/cmdbuild-multiple-stored-cross-site-scripting
third-party-advisory

Link	Providers	Tags
https://www.cmdbuild.org		product
https://www.cmdbuild.org/en/download/latest-version		product
https://www.exploit-db.com/exploits/50527		exploit
https://www.vulncheck.com/advisories/cmdbuild-multiple-stored-cross-site-scripting		third-party-advisory