{"id":"CVE-2021-30119","title":"Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `http…","summary":"Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `http…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"kaseya","product":"vsa","affected":["vsa < 9.5.7"],"patched":["vsa 9.5.7"],"published":"2021-07-09","updated":"2026-08-14","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2021-30119","references":[{"url":"https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/","label":"cve@mitre.org"},{"url":"https://csirt.divd.nl/CVE-2021-30119","label":"cve@mitre.org"},{"url":"https://csirt.divd.nl/DIVD-2021-00011","label":"cve@mitre.org"},{"url":"https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://csirt.divd.nl/CVE-2021-30119","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://csirt.divd.nl/DIVD-2021-00011","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","in-the-wild"],"epss":0.50323,"epssPercentile":0.9889,"exploited":true,"ingestedAt":"2026-08-14T06:15:27.604Z","slug":"CVE-2021-30119","body":"## Overview\n\nAuthenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=\";</script><script>alert(1);a=\"&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`\n\n## Affected\n\n- `vsa < 9.5.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `vsa 9.5.7`","depth":"twilight","depthScore":58,"depthScoreParts":{"impact":29.7,"likelihood":10.1,"exploitation":18,"ransomware":0},"changes":[]}