CVE-2021-27370
CVE-2021-27370
No sign of exploitation. has a public proof of concept.
Vexday Risk Score
23Low
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS —EPSS 3.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
22 Feb 2021Published on NVD
23 Feb 2021Public PoC
Weaponization speed
same dayto first PoC
Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.
Recommendation: Plan a near-term fix — a public PoC already exists.
The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/161501/Monica-2.19.1-Cross-Site-Scripting.htmlunverifiedexploitdbwww.exploit-db.com/exploits/49582unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.