CVE-2021-38709: Compo Composr CMS

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.

Affected products

• Compo Composr CMS: before 10.0.38 (fixed in 10.0.38)

Published 2021-08-16. Last modified 2026-06-17.