CVE-2021-47738 CSZ CMS 1.2.7 Persistent Cross-Site Scripting via Private Messaging

Medium 5.1 Published 23 Dec 2025 Updated 7 Apr 2026

Attackers can inject malicious JavaScript into private messages via the user-agent header, leading to code execution when admins view the messages.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-47738?

CVE-2021-47738 is a medium-severity cross-site scripting vulnerability in Cszcms CSZ CMS, published on 23 Dec 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attackers can send messages with script payloads in the user-agent header, which will execute when an admin views the message in the backend dashboard.

Weakness: CWE-79

Which versions are affected by CVE-2021-47738?

It affects 1 product.

Products include Cszcms Csz Cms.

How do I fix CVE-2021-47738?

No fix has been published for CVE-2021-47738 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-47738 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-47738 exists.

Sources

Also known as GHSA-ggjj-xc5q-883p.