CVE-2021-41182

mediumpriority · attend · 48EPSS 0.394 · 99 %ileexploit · PoCDEEUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

39.4% (99th) EPSS

CVSS 4.3 · medium

Is it mine?

103 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-27

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedendress_hauser_psirt
Update the software application of the affected products: | # | Product Name | Fixed Version | |----------------------------------|-----------------------------------------------|-------------------| | SCE30B | | | | SCE31B | SupplyCare Enterprise | >= 3.5.1 | | SCE32B | | | | SFE100 | DeviceCare | >= 1.07.07 | | SFE500 | FieldCare | >= 2.17.00 | | SMT50 | | | | SMT70 | Field Xpert | >= 1.06.00 | | SMT77 | | | | MS20 | | | | MS21 | Field Data Manager | >= 1.6.3 | | Freeware for the | | | | Proline Promag W 800/5W8C | Proline Promag W 800 OPC/UA Connectivity Server | > V1.3.7926 | | via Endress+Hauser Download Portal | | |
Mitigationendress_hauser_psirt
All vulnerabilities have already been fixed in several CodeMeter versions. Endress+Hauser recommends to use CodeMeter version >=7.40b. The version is available at https://www.wibu.com/support. For the Operating System WIN 7 it's recommended to update the operating system, use/re-install the Endress+Hauser Software Application supporting the newer operating system and update Code Meter to version >= 7.40b.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondary · security-advisories@github.comexploitability 2.8 · impact 3.6

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:Nsecondary · OSV

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · Endress+Hauser PSIRT DE

v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Hsecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USprimaryCWE-79USCWE-79US

exploits (1)

Public proof-of-concept and weaponised exploit code.

aredspy/CVE-2021-41182-TesterSome test files to make a good nuclei template for a JQuery UI XSS vulnPoC · poc_in_github

affected products (103)

Products and version ranges known to be affected.

Atlassian Confluence <10.0.2all versionscert_bundDE
Atlassian Confluence <10.1.1all versionscert_bundDE
Atlassian Confluence <8.5.25all versionscert_bundDE
Atlassian Confluence <9.2.7all versionscert_bundDE
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
SUSE Linuxall versionscert_bundDEcpe:/o:suse:suse_linux:-
Splunk Splunk Enterpriseall versionscert_bundDEcpe:/a:splunk:splunk:-
Splunk Splunk Enterprise <8.2.12all versionscert_bundDE
Splunk Splunk Enterprise <9.0.6all versionscert_bundDE
Splunk Splunk Enterprise <9.0.9all versionscert_bundDE
Splunk Splunk Enterprise <9.1.1all versionscert_bundDE
Splunk Splunk Enterprise <9.1.4all versionscert_bundDE
Splunk Splunk Enterprise <9.2.1all versionscert_bundDE
Atlassian Confluence< 10.0.2cert_bundDE
Atlassian Confluence< 10.1.1cert_bundDE
Atlassian Confluence< 8.5.25cert_bundDE
Atlassian Confluence< 9.2.7cert_bundDE
Splunk Splunk Enterprise< 8.2.12cert_bundDE
Splunk Splunk Enterprise< 9.0.6cert_bundDE
Splunk Splunk Enterprise< 9.0.9cert_bundDE

showing 20 of 103

advisories (9)

Vendor and ecosystem advisories describing this.

VDE-2022-019Endress+Hauser: Multiple products utilizing vulnerable WIBU-SYSTEMS CodeMeter components2022-06-02csaf · endress_hauser_psirtDE
For detailed information please refer to WIBU SYSTEMS original Advisories at https://wibu.com/support/security-advisories.html.
WID-SEC-W-2022-1729jQuery: Mehrere Schwachstellen ermöglichen Cross-Site ScriptingDeutsch2021-11-01csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in jQuery ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.
WID-SEC-W-2022-2368HCL BigFix: Mehrere SchwachstellenDeutsch2022-12-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um die Verfügbarkeit, die Vertraulichkeit und die Integrität zu gefährden.
WID-SEC-W-2023-2102Moodle: Mehrere SchwachstellenDeutsch2023-08-20csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Moodle ausnutzen, um Sicherheitsmechanismen zu umgehen, Informationen offenzulegen und SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen.
WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE
Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.
WID-SEC-W-2023-2309SAP Patchday September 2023Deutsch2023-09-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen oder manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2024-0117Oracle Retail Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-9gj3-hwp5-pmwcXSS in the `altField` option of the Datepicker widget in jquery-ui2021-10-26ghsa · osvUS
### Impact Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way: ```js $( "#datepicker" ).datepicker( { altField: "<img onerror='doEvilThing()' src='/404' />", } ); ``` will call the `doEvilThing` function. ### Patches The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. ### Workarounds A workaround is to not accept the value of the `altField` option from untrusted sources. ### For more information If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
BIT-drupal-2021-41182XSS in the `altField` option of the Datepicker widget2024-03-06vendor · osvUS
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector. A workaround is to not accept the value of the `altField` option from untrusted sources.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv cert_bund endress_hauser_psirt NVD CVE.org MITRE

published 2021-10-26modified 2026-06-17

related (53,008)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-42897US	medium6.1OT critical	70.7% (99th)	KEV	2026-05-14
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network…
CVE-2025-66376US	medium6.1OT critical	20.2% (97th)	KEV	2026-01-05
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
CVE-2025-68461US	medium6.1OT critical	27.4% (98th)	KEV	2025-12-18
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-48700US	—OT critical	1.71% (77th)	KEV	2025-06-23
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to exec…
CVE-2025-27915US	—OT critical	4.06% (91st)	KEV	2025-03-12
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient…

+53003 more

references (75)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan