Wiz
Vulnerability DatabaseCVE-2021-3977

CVE-2021-3977: 
PHP vulnerability analysis and mitigation

Overview

InvoiceNinja was found to be vulnerable to Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. The vulnerability was identified and assigned CVE-2021-3977, with the initial discovery and disclosure occurring in November 2021 (CVE MITRE).

Technical details

The vulnerability stems from improper neutralization of input during web page generation in the InvoiceNinja application, specifically affecting the client password reset functionality. The issue was located in the ContactForgotPasswordController.php file and involved how the application handled company key validation during password reset requests (GitHub Commit).

Impact

The Cross-site Scripting vulnerability could potentially allow attackers to inject malicious scripts into web pages viewed by other users, potentially leading to unauthorized access to user data or session hijacking (CVE MITRE).

Mitigation and workarounds

A fix was implemented through a commit that modified the client password reset functionality in the ContactForgotPasswordController.php file, changing how the application handles company key validation and contact lookups (GitHub Commit).

Additional resources

Source: This report was generated using AI

Related PHP vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

GHSA-898v-775g-777cCRITICAL9.4
  • PHPPHP
  • neuron-core/neuron-ai
NoYesDec 09, 2025
GHSA-5j8p-438x-rgg5CRITICAL9.3
  • PHPPHP
  • onelogin/php-saml
NoYesDec 09, 2025
GHSA-j8g6-5gqc-mq36HIGH8.2
  • PHPPHP
  • neuron-core/neuron-ai
NoYesDec 09, 2025
GHSA-pvcv-q3q7-266gHIGH8.1
  • PHPPHP
  • filament/filament
NoYesDec 09, 2025
GHSA-6w82-v552-wjw2HIGH7.1
  • PHPPHP
  • shopware/shopware
NoYesDec 09, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

Cloud Threat Landscape

A threat intelligence database

PEACH

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management
Get a demo