CVE-2021-25959: Opencrx

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.

Affected products

• Opencrx Opencrx: from 4.0.0, up to and including 5.1.0

Published 2021-09-29. Last modified 2026-06-17.