CVE-2021-31711 | Mend Vulnerability Database

Vulnerability DatabaseCVE-2021-31711

CVE-2021-31711

Published:May 09, 2023

Updated:May 17, 2026

Cross Site Scripting vulnerability found in Trippo ResponsiveFilemanager v.9.14.0 and before allows a remote attacker to execute arbitrary code via the sort_by parameter in the dialog.php file.

Affected Packages

zafranf/zetthcore (PHP):

Affected version(s) >=v1.0.0 <dev-L6

Fix Suggestion:

Update to version dev-L6

melisplatform/melis-core (PHP):

Affected version(s) >=v4.0.10 <v4.0.15

Fix Suggestion:

Update to version v4.0.15

fed/mce (PHP):

Affected version(s) >=0.0.1 <=0.0.2

Fix Suggestion:

Update to version no_fix

despark/html-template-curator (PHP):

Affected version(s) =v3.0

Fix Suggestion:

Update to version no_fix

therealworld/rte-module (PHP):

Affected version(s) =v5.1.10 <dev-oxid61

Fix Suggestion:

Update to version dev-oxid61

thelia/tinymce-module (PHP):

Affected version(s) =dev-master <1.0

Fix Suggestion:

Update to version 1.0

melisplatform/melis-core (PHP):

Affected version(s) >=dev-fix/bubble-plugins <dev-fix/gdpr-email-conf-smtp

Fix Suggestion:

Update to version dev-fix/gdpr-email-conf-smtp

melisplatform/melis-core (PHP):

Affected version(s) >=v3.2.1 <v4.0.8

Fix Suggestion:

Update to version v4.0.8

melisplatform/melis-core (PHP):

Affected version(s) =dev-update/tinymce6.7.0 <dev-php-7.0

Fix Suggestion:

Update to version dev-php-7.0

melisplatform/melis-core (PHP):

Affected version(s) =dev-update/fancytree-v2.37.0 <v3.0.0

Fix Suggestion:

Update to version v3.0.0

zafranf/zetthcore (PHP):

Affected version(s) >=dev-v0.1.3.4-mur <v0.1.9

Fix Suggestion:

Update to version v0.1.9

seguce92/filemanager (PHP):

Affected version(s) >=dev-master <v1.3.6

Fix Suggestion:

Update to version v1.3.6

fznoviar/responsivefilemanager (PHP):

Affected version(s) >=dev-master <9.9.4

Fix Suggestion:

Update to version 9.9.4

fznoviar/responsivefilemanager (PHP):

Affected version(s) =v9.10.1.1

Fix Suggestion:

Update to version no_fix

thelia/thelia (PHP):

Affected version(s) =dev-master <dev-modern-bo

Fix Suggestion:

Update to version dev-modern-bo

melisplatform/melis-core (PHP):

Affected version(s) =dev-fix/api <dev-fix/bo-lang-icon-column

Fix Suggestion:

Update to version dev-fix/bo-lang-icon-column

melisplatform/melis-core (PHP):

Affected version(s) >=dev-fix/2805 <=dev-fix/6658

Fix Suggestion:

Update to version no_fix

sovanet/eshop (PHP):

Affected version(s) =v1.0.0

Fix Suggestion:

Update to version no_fix

lekoala/silverstripe-form-extras (PHP):

Affected version(s) >=1.2.2 <1.2.13

Fix Suggestion:

Update to version 1.2.13

melisplatform/melis-core (PHP):

Affected version(s) >=v3.1.5 <v3.2.0

Fix Suggestion:

Update to version v3.2.0

vamcart/vamcart (PHP):

Affected version(s) >=2.4.41 <2.31

Fix Suggestion:

Update to version 2.31

fznoviar/responsivefilemanager (PHP):

Affected version(s) >=v9.9.4 <v9.10.1

Fix Suggestion:

Update to version v9.10.1

melisplatform/melis-core (PHP):

Affected version(s) =v4.1.0 <v4.1.1

Fix Suggestion:

Update to version v4.1.1

melisplatform/melis-core (PHP):

Affected version(s) >=v3.1.0 <v3.1.2

Fix Suggestion:

Update to version v3.1.2

rokorolov/parus-basic-app (PHP):

Affected version(s) >=dev-master <=dev-release/1.1

Fix Suggestion:

Update to version no_fix

imagecms/imagecms (PHP):

Affected version(s) =dev-phpunit <v1.0.5

Fix Suggestion:

Update to version v1.0.5

melisplatform/melis-core (PHP):

Affected version(s) >=dev-fix/reset-pwd <dev-update/change-composer-version

Fix Suggestion:

Update to version dev-update/change-composer-version

crabstudio/app (PHP):

Affected version(s) >=3.2.6 <dev-revert-244-jsonview-serialization

Fix Suggestion:

Update to version dev-revert-244-jsonview-serialization

imagecms/imagecms (PHP):

Affected version(s) =v4.8.1 <v4.9

Fix Suggestion:

Update to version v4.9

dimaninc/di_core (PHP):

Affected version(s) >=dev-composer <0.2.0

Fix Suggestion:

Update to version 0.2.0

amirkoklan/responsivefilemanager (PHP):

Affected version(s) >=v9.9.4 <v9.10.1

Fix Suggestion:

Update to version v9.10.1

despark/html-template-curator (PHP):

Affected version(s) =dev-master <v.1.0

Fix Suggestion:

Update to version v.1.0

ahyadessam/laravel-adminlte (PHP):

Affected version(s) >=1.0.5 <1.1.4

Fix Suggestion:

Update to version 1.1.4

amirkoklan/responsivefilemanager (PHP):

Affected version(s) >=dev-master <9.9.4

Fix Suggestion:

Update to version 9.9.4

amirkoklan/responsivefilemanager (PHP):

Affected version(s) >=v9.10.2 <=v9.12.1

Fix Suggestion:

Update to version no_fix

lekoala/silverstripe-form-extras (PHP):

Affected version(s) =dev-master <1.0.0

Fix Suggestion:

Update to version 1.0.0

crabstudio/app (PHP):

Affected version(s) =dev-master <dev-master-license-removal

Fix Suggestion:

Update to version dev-master-license-removal

brucecms/pages (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

zafranf/zetthcore (PHP):

Affected version(s) >=v0.0.0 <v0.1.0

Fix Suggestion:

Update to version v0.1.0

thelia/tinymce-module (PHP):

Affected version(s) =2.4.0 <2.4.0-apha1

Fix Suggestion:

Update to version 2.4.0-apha1

therealworld/rte-module (PHP):

Affected version(s) >=v1.5.1 <v1.7.0

Fix Suggestion:

Update to version v1.7.0

deimon/sandbox-project (PHP):

Affected version(s) =dev-master <1.0.2

Fix Suggestion:

Update to version 1.0.2

panix/wgt-tinymce (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

ronappleton/radmin-tinymce (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

dimaninc/di_core (PHP):

Affected version(s) >=0.3.0 <=0.3.1

Fix Suggestion:

Update to version no_fix

shurupov/qengine (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

melisplatform/melis-core (PHP):

Affected version(s) >=dev-fix/multi-val-input-label <dev-fix/reset-password-link

Fix Suggestion:

Update to version dev-fix/reset-password-link

laravelcity/laravel-filemanager (PHP):

Affected version(s) =dev-master

Fix Suggestion:

Update to version no_fix

vamcart/vamcart (PHP):

Affected version(s) =v2.4.4 <2.4.5

Fix Suggestion:

Update to version 2.4.5

vamcart/vamcart (PHP):

Affected version(s) >=2.37 <2.56.1

Fix Suggestion:

Update to version 2.56.1

thelia/tinymce-module (PHP):

Affected version(s) >=2.4.x-dev <2.5.0-alpha1

Fix Suggestion:

Update to version 2.5.0-alpha1

thelia/thelia (PHP):

Affected version(s) >=2.4.0 <2.5.0-alpha1

Fix Suggestion:

Update to version 2.5.0-alpha1

melisplatform/melis-core (PHP):

Affected version(s) =v4.0.17 <v4.0.18

Fix Suggestion:

Update to version v4.0.18

Related Resources (1)

https://github.com/trippo/ResponsiveFilemanager/issues/661

Do you need more information?

CVSS v4

Base Score:

5.1

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

LOW

User Interaction

PASSIVE

Vulnerable System Confidentiality

LOW

Vulnerable System Integrity

LOW

Vulnerable System Availability

NONE

Subsequent System Confidentiality

LOW

Subsequent System Integrity

LOW

Subsequent System Availability

NONE

CVSS v3

Base Score:

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Weakness Type (CWE)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-79

EPSS

Base Score:

0.30