Security readout for executives and security teams
Plain-English summary
CVE-2021-27822 is a stored XSS issue in the Add Categories module of Vehicle Parking Management System 1.0. Malicious content entered in the Category field can be saved and later run in another user’s browser. The public record does not provide CVSS, vendor, or patch details.
Executive priority
Treat as a targeted application risk, not a broad enterprise emergency. Prioritize if the system is internet-facing, used by multiple roles, or stores sensitive sessions. Lack of patch detail means owners should verify vendor guidance quickly.
Technical view
The CVE description reports persistent cross-site scripting through the Category field in the Add Categories module. Impact depends on who can create categories and who later views them. The bundle includes an Exploit-DB reference, but no KEV listing, CVSS vector, CWE, patch, or validated vendor advisory.
Likely exposure
Exposure is likely limited to organizations running Vehicle Parking Management System 1.0, especially if category management is reachable by untrusted or lower-privileged users. Structured affected-product metadata is incomplete in the source bundle.
Exploitation context
A public Exploit-DB reference exists, indicating public exploit information. The CVE is not listed as KEV in the provided bundle, and no cited source states active exploitation in the wild.
Researcher notes
Key uncertainty is metadata quality: the CVE record names the vulnerable module and field, but affected vendor/product fields are listed as n/a and no CVSS is supplied. Do not infer broader product families or active exploitation from the available evidence.
Mitigation direction
- Confirm whether Vehicle Parking Management System 1.0 is deployed.
- Check vendor or project guidance for a fixed release or official workaround.
- Restrict Add Categories access to trusted administrators until remediated.
- For maintained code, validate input and output-encode stored Category values.
- Review existing category records for suspicious HTML or script content.
Validation and detection
- Inventory internet-facing and internal instances of the application.
- Review user roles allowed to access Add Categories.
- Inspect stored category values for unexpected HTML or script markup.
- Confirm browser execution is blocked after remediation in a safe test environment.
- Document patch status or compensating controls for each deployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2021-27822 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.exploit-db.com/exploits/49595CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.