CVE-2021-37794
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-37794
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
FileBrowser 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FileBrowser是开源的一款网页文件浏览器。提供指定目录下的文件管理界面，可用于上传、删除、预览、重命名和编辑您的文件。它允许创建多个用户，每个用户可以有自己的目录。它可以用作独立的应用程序或中间件。 FileBrowser 2.16.0存在跨站脚本漏洞，该漏洞源于软件对于上传的svg文件没有进行有效的验证和过滤，允许经过身份验证的用户授权上传一个恶意的.svg文件，该文件作为存储的跨站点脚本有效载荷。如果这个存储的XSS有效负载由管理员触发，它将在运行FileBrowser实例的服务器上触发恶意操
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2021-37794
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-37794
请登录查看更多情报信息。
- https://github.com/filebrowser/filebrowserx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2021-37794
Same Patch Batch · n/a · 2021-08-31 · 33 CVEs total
| CVE-2021-22684 | Samsung Galaxy Gear Series Tizen 输入验证错误漏洞 | |
| CVE-2021-40330 | Git 处理逻辑错误漏洞 | |
| CVE-2021-36981 | SerNet verinice 代码问题漏洞 | |
| CVE-2021-3634 | Libssh 缓冲区错误漏洞 | |
| CVE-2021-27556 | Nature Easy Soft Network Technology ZenTao 操作系统命令注入漏洞 | |
| CVE-2021-27557 | Nature Easy Soft Network Technology ZenTao 跨站请求伪造漏洞 | |
| CVE-2021-27558 | Nature Easy Soft Network Technology ZenTao 跨站脚本漏洞 | |
| CVE-2021-36356 | Kramer Electronics VIAware 代码问题漏洞 | |
| CVE-2020-13639 | Outsystems OutSystems Platform 跨站脚本漏洞 | |
| CVE-2021-38145 | Form Tools SQL注入漏洞 | |
| CVE-2021-38143 | Form Tools 跨站脚本漏洞 | |
| CVE-2021-38144 | Form Tools 跨站脚本漏洞 | |
| CVE-2020-19046 | S-CMS 跨站脚本漏洞 | |
| CVE-2020-19047 | iWebShop 跨站请求伪造漏洞 | |
| CVE-2020-19048 | MyBB 跨站脚本漏洞 | |
| CVE-2020-19049 | MyBB 跨站脚本漏洞 | |
| CVE-2020-20495 | bludit 安全漏洞 | |
| CVE-2021-22944 | Ubiquiti Networks UniFi Protect 访问控制错误漏洞 | |
| CVE-2021-22943 | Ubiquiti Networks UniFi Protect 授权问题漏洞 | |
| CVE-2021-22929 | Brave 日志信息泄露漏洞 |
Showing top 20 of 33 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: n/a
- CVE-2026-8747
Z-BlogPHP Commend Approval c_system_event.php CheckComment i - CVE-2026-8746
Open5GS NRF nghttp2-server.c discover_handler use after free - CVE-2026-8745
Open5GS AUSF nausf-handler.c ogs_timer_add denial of service - CVE-2026-8744
Open5GS NRF context.c ogs_sbi_nf_service_add denial of servi - CVE-2026-8743
Open5GS AMF/MME context.c ran_ue_find_by_amf_ue_ngap_id impr
V. Comments for CVE-2021-37794
No comments yet