{"id":"CVE-2021-25993","details":"In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.","modified":"2026-07-08T05:56:56.202452912Z","published":"2021-12-29T17:15:07.483Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"introduced":"2.0.0-beta147"},{"last_affected":"2.0.0-beta147"},{"introduced":"2.0.0-beta148"},{"last_affected":"2.0.0-beta148"},{"introduced":"2.0.0-beta174"},{"last_affected":"2.0.0-beta174"},{"introduced":"2.0.0-beta180"},{"last_affected":"2.0.0-beta180"},{"introduced":"2.0.0-beta203"},{"last_affected":"2.0.0-beta203"},{"introduced":"2.0.0-beta208"},{"last_affected":"2.0.0-beta208"},{"introduced":"2.0.0-beta230"},{"last_affected":"2.0.0-beta230"},{"introduced":"2.0.0-beta241"},{"last_affected":"2.0.0-beta241"},{"introduced":"2.0.0-beta267"},{"last_affected":"2.0.0-beta267"},{"introduced":"2.0.0-beta268"},{"last_affected":"2.0.0-beta268"},{"introduced":"2.0.0-beta275"},{"last_affected":"2.0.0-beta275"},{"introduced":"2.0.0-beta303"},{"last_affected":"2.0.0-beta303"},{"introduced":"2.0.0-rc1"},{"last_affected":"2.0.0-rc1"},{"introduced":"2.0.0-rc17"},{"last_affected":"2.0.0-rc17"}],"source":"CPE_STRING","vendor_product":"requarks:wiki.js","cpes":["cpe:2.3:a:requarks:wiki.js:2.0.0:beta147:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta148:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta174:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta180:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta203:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta208:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta230:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta241:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta267:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta268:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta275:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:beta303:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:rc17:*:*:*:*:*:*","cpe:2.3:a:requarks:wiki.js:2.0.0:rc1:*:*:*:*:*:*"]}]},"references":[{"type":"FIX","url":"https://github.com/Requarks/wiki/commit/5d3e81496fba1f0fbd64eeb855f30f69a9040718"},{"type":"EVIDENCE","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25993"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/requarks/wiki","events":[{"introduced":"b5d773caecaad2cc592f6a399dbc6c965d5d855b"},{"last_affected":"5173c4802e3bf52334d8ee78d5c687a49f724275"},{"fixed":"5d3e81496fba1f0fbd64eeb855f30f69a9040718"}],"database_specific":{"source":["CPE_RANGE","REFERENCES"],"cpe":"cpe:2.3:a:requarks:wiki.js:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0.1"},{"last_affected":"2.5.255"}]}}],"versions":["2.5.255","2.5.254","2.5.219","2.5.214","2.5.201","2.5.197","2.5.191","2.5.170","2.5.159","2.5.144","2.5.136","2.5.132","2.5.126","2.5.121","2.5.117","2.5.105","2.4.107","2.4.105","2.4.75","2.3.77","2.3.72","2.3.71","2.2.51","2.2.50","2.1.113","2.0.12","2.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25993.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}