CVE-2021-47729 Selea Targa IP Camera Stored Cross-Site Scripting via Files List

Medium 5.1 Published 9 Dec 2025 Updated 7 Apr 2026

Attackers can inject malicious scripts into the camera's file list, allowing arbitrary code execution in victim browsers.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-47729?

CVE-2021-47729 is a medium-severity cross-site scripting vulnerability in Selea Targa IP OCR-ANPR Camera, published on 9 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Selea Targa IP OCR-ANPR Camera contains a stored cross-site scripting vulnerability in the 'files_list' parameter that allows attackers to inject malicious HTML and script code. Attackers can send a POST request to /cgi-bin/get_file.php with crafted payload to execute arbitrary scripts in victim's browser session.

Weakness: CWE-79

Which versions are affected by CVE-2021-47729?

It affects 12 products.

Products include Selea Carplateserver, Selea Izero Box Full Firmware, Selea Izero Column Entry\/8 Firmware, Selea Izero Column Full\/8 Firmware, Selea Targa 504 Firmware, Selea Targa 512 Firmware and 6 more.

How do I fix CVE-2021-47729?

No fix has been published for CVE-2021-47729 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-47729 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47729 exists.

Sources

Also known as GHSA-56x4-vcv9-c6cw.