Vulnerability record · CVE-2021-44916 · published 20 December 2021

CVE-2021-44916: Opmantek open-audit cross-site scripting vulnerability

Opmantek · Open Audit

Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.

6.1 CVSS 3.1 Medium EPSS 3.7% · top 10.6% CWE-79 · Cross-site scripting

6.1CVSS 3.1 base score, v2 4.3

3.7%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Open Audit Opmantek

References

Link	Tags
http://packetstormsecurity.com/files/165502/Open-AudIT-Community-4.2.0-Cross-Site-Scripting.html	ExploitThird Party AdvisoryVDB Entry
https://community.opmantek.com/display/OA/Errata+-+4.2.0+and+earlier+Javascript+vulnerability	MitigationPatchVendor Advisory
https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v4.3.0	Release NotesVendor Advisory
https://github.com/Opmantek/open-audit/commit/e37b64bbd0219f03cb71cc1cd5bb010166a2b846	PatchThird Party Advisory
http://packetstormsecurity.com/files/165502/Open-AudIT-Community-4.2.0-Cross-Site-Scripting.html	ExploitThird Party AdvisoryVDB Entry
https://community.opmantek.com/display/OA/Errata+-+4.2.0+and+earlier+Javascript+vulnerability	MitigationPatchVendor Advisory
https://community.opmantek.com/display/OA/Release+Notes+for+Open-AudIT+v4.3.0	Release NotesVendor Advisory
https://github.com/Opmantek/open-audit/commit/e37b64bbd0219f03cb71cc1cd5bb010166a2b846	PatchThird Party Advisory

Track CVE-2021-44916 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40612Opmantek open-audit vulnerabilityAn issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php …EPSS 2.0%22 Dec 2021 9.8CVE-2020-11942Opmantek open-audit sql injection vulnerabilityAn issue was discovered in Open-AudIT 3.2.2. There are Multiple SQL Injections.EPSS 1.2%29 Apr 2020 8.8CVE-2020-11943Opmantek open-audit unrestricted file upload vulnerabilityAn issue was discovered in Open-AudIT 3.2.2. There is Arbitrary file upload.EPSS 24%29 Apr 2020 8.8CVE-2020-12078Opmantek open-audit os command injection vulnerabilityAn issue was discovered in Open-AudIT 3.3.1. There is shell metacharacter injection via attributes to an open-audit/configuration/ URI. An attacker c…EPSS 10.0%28 Apr 2020 8.8CVE-2020-11941Opmantek open-audit os command injection vulnerabilityAn issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.EPSS 4.6%27 Apr 2020 8.8CVE-2020-8813Cacti graph_realtime.php OS command injection via cookiegraph_realtime.php in Cacti 1.2.8 passes cookie data into a shell command without sanitization, allowing OS command injection through shell metachara…EPSS 74%analysed22 Feb 2020 8.8CVE-2019-16293Opmantek open-audit os command injection vulnerabilityThe Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a…EPSS 1.6%13 Sep 2019 6.5CVE-2021-44674Opmantek open-audit path traversal vulnerabilityAn information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outsi…EPSS 1.0%3 Jan 2022

Source: NIST National Vulnerability Database (record CVE-2021-44916), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.