CVE-2021-36387: Yellowfinbi Yellowfin

Medium severity, CVSS 5.4. EPSS: 1.5% chance of exploitation in the next 30 days.

In Yellowfin before 9.6.1 there is a Stored Cross-Site Scripting vulnerability in the video embed functionality exploitable through a specially crafted HTTP POST request to the page "ActivityStreamAjax.i4".

Affected products

• Yellowfinbi Yellowfin: before 9.6.1 (fixed in 9.6.1)

Published 2021-10-14. Last modified 2026-06-17.