VYPR
← All advisories
Medium severity5.4NVD Advisory· Published May 25, 2021· Updated Jun 17, 2026

CVE-2021-25935

CVE-2021-25935

Description

In OpenNMS Horizon, versions opennms-17.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function add() performs improper validation checks on the input sent to the foreign-source parameter. Due to this flaw an attacker could bypass the existing regex validation and inject an arbitrary script which will be stored in the database.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Opennms/Horizon2 versions
    cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:opennms:horizon:*:*:*:*:*:*:*:*range: >=17.0.0,<=27.1.0
    • (no CPE)range: opennms-17.0.0-1 through opennms-27.1.0-1
  • Opennms/Meridian2 versions
    cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:opennms:meridian:*:*:*:*:*:*:*:*range: >=2015.1.0,<=2019.1.18
    • (no CPE)range: meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1
  • OpenNMS/OpenNMS Horizondescription
  • Opennms/Opennmsllm-fuzzy
    Range: opennms-17.0.0-1 through opennms-27.1.0-1

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.