CVE-2021-33387

CRITICAL

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.

Affects 1 product across 1 vendor.

CVSS 3.19.6
EPSS0.8%
Percentile57th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, requires user interaction, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-79: Cross-Site Scripting (XSS)

Attacker injects malicious scripts into web pages viewed by other users, executing in the victim's browser context.

Related Attack Patterns (CAPEC)
CAPEC-85 AJAX Footprinting
via CWE-79
CAPEC-209 XSS Using MIME Type Mismatch
via CWE-79
CAPEC-588 DOM-Based XSS
via CWE-79
CAPEC-591 Reflected XSS
via CWE-79
CAPEC-592 Stored XSS
via CWE-79
Show all 6
via CWE-79

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A Cross Site Scripting (XSS) vulnerability in MiniCMS v.1.10 allows attackers to execute arbitrary code through a crafted GET request, posing a significant security risk.

BSID: BS-2023-GLOBAL-278070-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2021-33387?
A Cross Site Scripting (XSS) vulnerability in MiniCMS v.1.10 allows attackers to execute arbitrary code through a crafted GET request, posing a significant security risk.
What is the CVSS score for CVE-2021-33387?
CVE-2021-33387 has CVSS 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2021-33387 actively exploited?
No confirmed active exploitation of CVE-2021-33387 as of 2026-05-30.
How do I remediate CVE-2021-33387?
Priority: IMMEDIATE.
What systems are affected by CVE-2021-33387?
CVE-2021-33387 affects 1234N Minicms.
Vulnerability Details
CVE IDCVE-2021-33387
BSIDBS-2023-GLOBAL-278070-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Published2023-02-24
Last Modified2025-03-12
ICS Relevance0%
Weakness (CWE)
Cross-Site Scripting (XSS)
SourceNVD
Official Description

Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability arises from improper validation and sanitization of user input in GET requests, enabling attackers to inject malicious scripts that can be executed in the context of other users' browsers.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
1234N Minicms 1.10
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1329 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hasha22194cefafa53cbdc68fffcf7b3e4df1c46752115853bbdf77cd43c09024a2bf009b3d1060d251dcf4c06f6cb54798e8d87a9b59b13fcd7430dccf7f3982edf
Related CVEs affecting 1234N
CVE-2025-15457 9.8 A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element i... CVE-2020-19896 9.8 File inclusion vulnerability in Minicms v1.9 allows remote attackers to execu... CVE-2020-36052 9.8 Directory traversal vulnerability in post-edit.php in MiniCMS V1.10 allows re... CVE-2018-18892 9.8 MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php siten... CVE-2025-15458 9.8 A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an u...
View all 1234N CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.6 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →