### [CVE-2021-43032](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43032)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brightgreen)

### Description

In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.

### POC

#### Reference
- https://github.com/SakuraSamuraii/CVE-2021-43032

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/SakuraSamuraii/CVE-2021-43032
- https://github.com/nomi-sec/PoC-in-GitHub