CVE-2021-27888: Zend Zendto

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.

Affected products

• Zend Zendto: up to and including 6.05-4; version 6.06-1 only; version 6.06-2 only; version 6.06-3 only

Published 2021-03-02. Last modified 2026-06-17.