CVE-2021-25993

🔶 medium

Summary

In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim.

CVSS Score

5.4

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2021-12-29

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 22.8% of all 326,604 vulnerabilities in our database.

#252,020

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 30, 2025

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

🏆 Discovered By

WhiteSource Vulnerability Research Team (WVR)

SSVC data provided by CISA

Last Modified 2024-11-21

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CWE IDs (Weakness Types)

CWE-79

📦 Affected Products 2

Vendor	Product	Status	Affected Versions
requarks	wiki.js	Affected	≥ 2.0.1 ≤ 2.5.255
requarks	wiki.js	Affected	v2.0.0

🔗 References 2

https://github.com/Requarks/wiki/commit/5d3e81496fba...

Patch Third Party Advisory

https://www.whitesourcesoftware.com/vulnerability-da...

Exploit Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-44224	⚠️ high	8.8	0.1	Wiki.js is an open source wiki app built on Node.js. Prior to 2.5.313, the users.update GraphQL mutation accepts an arbi...	2026-05-12
CVE-2025-56643	⛔ critical	9.1	0.1	Requarks Wiki.js 2.5.307 does not properly revoke or invalidate active JWT tokens when a user logs out. As a result, pre...	2025-11-18
CVE-2022-1681	⚠️ high	7.2	0.3	Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can g...	2022-05-12
CVE-2022-23654	⚠️ high	8.1	0.2	Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set...	2022-02-22
CVE-2021-43855	⚠️ high	8.2	0.4	Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through...	2021-12-27
CVE-2021-43856	⚠️ high	8.2	0.4	Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through...	2021-12-27

These CVEs affect the same products