{"id":"GHSA-hfm8-2q22-h7hv","aliases":["CVE-2021-43561"],"title":"Cross-site Scripting in pegasus/google-for-jobs","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.","severity":"medium","score":5.4,"published":"2021-11-15T17:39:18.000Z","modified":"2023-11-08T04:07:10.400Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"pegasus/google-for-jobs","sources":[{"name":"OSV · GHSA-hfm8-2q22-h7hv","url":"https://osv.dev/vulnerability/GHSA-hfm8-2q22-h7hv"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"1.5.1"}],"type":"ECOSYSTEM"}],"versions":["1.1.0","1.1.1","1.2.0","1.3.0","1.4.0","1.5.0"],"fixed":["1.5.1"]},{"ecosystem":"Packagist","name":"pegasus/google-for-jobs","sources":[{"name":"OSV · GHSA-hfm8-2q22-h7hv","url":"https://osv.dev/vulnerability/GHSA-hfm8-2q22-h7hv"}],"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.1.1"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.1.0"],"fixed":["2.1.1"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-43561","https://github.com/pegasuswerbeagentur/google_for_jobs","https://typo3.org/security/advisory/typo3-ext-sa-2021-015"],"sources":[{"name":"OSV","id":"GHSA-hfm8-2q22-h7hv","modified":"2023-11-08T04:07:10.400650Z","url":"https://osv.dev/vulnerability/GHSA-hfm8-2q22-h7hv"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","score":5.4}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T11:55:31.891Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}