CVE-2021-26549: Smartfoxserver

Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days.

An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.

Affected products

• Smartfoxserver Smartfoxserver: version 2.17.0 only

Published 2021-02-09. Last modified 2026-06-17.