CVE-2021-3294: CASAP Automated Enrollment System 1.0 is affected by cross-site scripting (XSS) in users.php.

Security readout for executives and security teams

CVE-2021-3294 is a cross-site scripting issue in CASAP Automated Enrollment System 1.0, specifically users.php. If exploited, an attacker could run unwanted browser-side script, potentially steal a user cookie or redirect a user to a malicious site. No source provided evidence of active exploitation in the wild. Exposure is likely limited to organizations running CASAP Automated Enrollment System 1.0, especially if the application is internet-facing or accessible to untrusted users. The provided affected-product metadata is incomplete, so confirm by application name, version, and code path rather than CPE matching. Treat as a targeted application risk, not a broad enterprise emergency. Prioritize if CASAP handles sensitive enrollment data, is internet-facing, or lacks strong session protections. If not deployed, no action is needed beyond documenting non-exposure. Mitigation focus: Check the project or vendor source for any updated release or security guidance.; Restrict access to the enrollment system to trusted networks or VPN where feasible.; Review users.php for unsafe input reflection and apply output encoding..

Prepared

Jul 9, 2026, 08:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.