CVE-2021-45224: Coins-Global Coins Construction Cloud

Medium severity, CVSS 6.1. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application, JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefore vulnerable to reflected XSS via malicious URLs.

Affected products

Published 2022-01-24. Last modified 2026-06-17.