CVE-2021-32828: Hyland Nuxeo

Medium severity, CVSS 6.1. EPSS: 0.7% chance of exploitation in the next 30 days.

The Nuxeo Platform is an open source content management platform for building business applications. In version 11.5.109, the `oauth2` REST API is vulnerable to Reflected Cross-Site Scripting (XSS). This XSS can be escalated to Remote Code Execution (RCE) by levering the automation API.

Affected products

• Hyland Nuxeo: up to and including 11.5.109

Published 2023-01-05. Last modified 2026-06-17.