CVE-2021-40191

Published: 2021-10-11T14:15Z

Last Modified: 2024-11-21T06:23Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Dzzoffice Version 2.02.1 is affected by cross-site scripting (XSS) due to a lack of sanitization of input data at all upload functions in webroot/dzz/attach/Uploader.class.php and return a wrong response in content-type of output data in webroot/dzz/attach/controller.php. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt