Medium severity5.4NVD Advisory· Published Apr 23, 2021· Updated Jun 17, 2026
CVE-2021-31583
CVE-2021-31583
Description
Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- cpe:2.3:a:sipwise:next_generation_communication_platform:3.6.7:*:*:*:ce:*:*:*
- Sipwise/C5 NGCP WWW Admindescription
- Range: 3.6.7 up to and including NGCP CE 3.0
Patches
Vulnerability mechanics
References
5- lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.htmlnvdExploitMailing ListThird Party Advisory
- packetstormsecurity.com/files/162316/Sipwise-C5-NGCP-CSC-Cross-Site-Scripting.htmlnvdExploitThird Party AdvisoryVDB Entry
- www.zeroscience.mk/en/vulnerabilitiesnvdExploitThird Party Advisory
- www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5648.phpnvdExploitThird Party Advisory
- www.sipwise.comnvdProduct
News mentions
0No linked articles in our index yet.