{"api_version":"1","generated_at":"2026-07-24T04:45:09+00:00","cve":"CVE-2021-25790","urls":{"html":"https://cve.report/CVE-2021-25790","api":"https://cve.report/api/cve/CVE-2021-25790.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2021-25790","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2021-25790"},"summary":{"title":"CVE-2021-25790","description":"Multiple stored cross site scripting (XSS) vulnerabilities in the \"Register\" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2021-07-23 18:15:00","updated_at":"2021-09-13 14:45:00"},"problem_types":["CWE-79"],"metrics":[],"references":[{"url":"https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html","name":"https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html","refsource":"MISC","tags":[],"title":"House Rental and Property Listing in PHP with Full Source Code | Free Source Code, Projects & Tutorials","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.sourcecodester.com","name":"https://www.sourcecodester.com","refsource":"MISC","tags":[],"title":"Free Source Code Projects and Tutorials - sourcecodester.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.exploit-db.com/exploits/49352","name":"https://www.exploit-db.com/exploits/49352","refsource":"MISC","tags":[],"title":"House Rental and Property Listing 1.0 - Multiple Stored XSS - PHP webapps Exploit","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-25790","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25790","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2021","cve_id":"25790","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"house-rental-and-property-listing-php-full-source-code_project","cpe5":"house-rental-and-property-listing-php-full-source-code","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"25790","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"house_rental_and_property_listing_php_full_source_code_project","cpe5":"house_rental_and_property_listing_php_full_source_code","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2021","cve_id":"25790","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"house_rental_and_property_listing_php_project","cpe5":"house_rental_and_property_listing_php","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2021-25790","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Multiple stored cross site scripting (XSS) vulnerabilities in the \"Register\" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://www.sourcecodester.com","refsource":"MISC","name":"https://www.sourcecodester.com"},{"url":"https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html","refsource":"MISC","name":"https://www.sourcecodester.com/php/14649/house-rental-and-property-listing-php-full-source-code.html"},{"url":"https://www.exploit-db.com/exploits/49352","refsource":"MISC","name":"https://www.exploit-db.com/exploits/49352"}]}},"nvd":{"publishedDate":"2021-07-23 18:15:00","lastModifiedDate":"2021-09-13 14:45:00","problem_types":["CWE-79"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.3,"impactScore":2.7},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":3.5},"severity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:house_rental_and_property_listing_php_project:house_rental_and_property_listing_php:1.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2021","CveId":"25790","Ordinal":"200624","Title":"CVE-2021-25790","CVE":"CVE-2021-25790","Year":"2021"},"notes":[{"CveYear":"2021","CveId":"25790","Ordinal":"1","NoteData":"Multiple stored cross site scripting (XSS) vulnerabilities in the \"Register\" module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.","Type":"Description","Title":null},{"CveYear":"2021","CveId":"25790","Ordinal":"2","NoteData":"2021-07-23","Type":"Other","Title":"Published"},{"CveYear":"2021","CveId":"25790","Ordinal":"3","NoteData":"2021-07-23","Type":"Other","Title":"Modified"}]}}}