CVE-2021-47743
COMMAX Biometric Access Control System 1.0.0 Reflected XSS via Cookie Parameters
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
COMMAX Biometric Access Control System 1.0.0 contains an unauthenticated reflected cross-site scripting vulnerability in cookie parameters 'CMX_ADMIN_NM' and 'CMX_COMPLEX_NM'. Attackers can inject malicious HTML and JavaScript code into these cookie values to execute arbitrary scripts in a victim's browser session.
| CWE | CWE-79 |
| Vendor | commax co., ltd. |
| Product | commax biometric access control system |
| Published | Dec 31, 2025 |
| Last Updated | May 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for commax co., ltd. commax biometric access control system
Be the first to know when new medium vulnerabilities affecting commax co., ltd. commax biometric access control system are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Affected Versions
COMMAX Co., Ltd. / COMMAX Biometric Access Control System
1.0.0
References
zeroscience.mk: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5660.php packetstormsecurity.com: https://packetstormsecurity.com/files/163834 exchange.xforce.ibmcloud.com: https://exchange.xforce.ibmcloud.com/vulnerabilities/207578 cxsecurity.com: https://cxsecurity.com/issue/WLB-2021080063 commax.com: https://www.commax.com/ vulncheck.com: https://www.vulncheck.com/advisories/commax-biometric-access-control-system-reflected-xss-via-cookie-parameters
Credits
LiquidWorm as Gjoko Krstic of Zero Science Lab