Medium severity5.4NVD Advisory· Published Dec 23, 2025· Updated Jun 17, 2026

CVE-2021-47738

Description

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

CSZ CMS/cszcmsllm-fuzzy3 versions
<1.2.7+ 2 more
- (no CPE)range: <1.2.7
- (no CPE)range: 1.2.7
- cpe:2.3:a:cszcms:csz_cms:1.2.7:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

www.exploit-db.com/exploits/48354nvdExploitThird Party AdvisoryVDB Entry
www.vulncheck.com/advisories/csz-cms-persistent-cross-site-scripting-via-private-messagingnvdThird Party Advisory
sourceforge.net/projects/cszcms/nvdProduct
www.cszcms.comnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000