Cyber Resilience

CVE-2021-47835

MediumPublic PoC

Published: 16 January 2026

Published
16 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v4 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0004 13.1th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-47835 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Freeter (inferred from references). Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique JavaScript (T1059.007); ranked at the 13.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2021-47835 is a persistent cross-site scripting vulnerability (CWE-79) affecting Freeter version 1.2.1. The flaw enables attackers to store malicious payloads in custom widget titles and files within the application.

Remote attackers require no privileges (PR:N) to exploit this issue over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation executes embedded scripts when victims interact with affected custom widgets or files, potentially enabling remote code execution, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

VulnCheck advisories (https://www.vulncheck.com/advisories/freeter-persistent-cross-site-scripting) provide further details on the vulnerability. A proof-of-concept exploit is available at https://www.exploit-db.com/exploits/49833, with supporting images at https://imgur.com/a/iBuKWm4. The vendor site is https://freeter.io/.

EU & UK References

Vulnerability details

Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads in custom widget titles and files. Attackers can craft malicious files with embedded scripts that execute when victims interact with the application, potentially enabling remote…

more

code execution.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Stored XSS directly enables arbitrary JavaScript execution (T1059.007) in the Freeter app context and constitutes exploitation of a vulnerable public-facing application component (T1190).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3231Shared CWE-79
CVE-2025-23481Shared CWE-79
CVE-2025-69302Shared CWE-79
CVE-2025-23734Shared CWE-79
CVE-2025-23571Shared CWE-79
CVE-2025-65110Shared CWE-79
CVE-2026-24948Shared CWE-79
CVE-2025-27352Shared CWE-79
CVE-2025-30349Shared CWE-79
CVE-2026-3876Shared CWE-79

Affected Assets

Freeter
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Enforces validation and sanitization of all user-supplied data (widget titles and uploaded files) to reject or neutralize embedded scripts before storage.

prevent

Requires output filtering/encoding of rendered widget content so that stored malicious scripts are neutralized before execution in victims' browsers.

preventdetect

Deploys malicious-code detection mechanisms that can identify and block script payloads in files or widget data at rest or on access.

References