← Vulnerability feed

Vulnerability record · CVE-2021-34801 · published 16 June 2021

CVE-2021-34801: Valine.js valine vulnerability

VValine.Js · Valine

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.

5.3 CVSS 3.1 Medium EPSS 1.7% · top 23.4%
5.3CVSS 3.1 base score, v2 5.0
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/xCss/Valine/issues/366 ExploitIssue TrackingThird Party Advisory
https://github.com/xCss/Valine/issues/366 ExploitIssue TrackingThird Party Advisory

Track CVE-2021-34801 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.6CVE-2022-38545Valine.js valine cross-site scripting vulnerabilityValine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted P…EPSS 33%6.1CVE-2018-19289Valine.js valine cross-site scripting vulnerabilityAn issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjuncti…EPSS 1.2%5.4CVE-2020-28847Valine.js valine cross-site scripting vulnerabilityCross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2021-34801), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.