Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43661 State: PUBLISHED Published: 2022-03-30T23:19:19 Last Updated: 2024-08-04T04:03:08.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chibataiki/iot-vuls/blob/main/totolink/xss-vulnerability.md
CVE ID: CVE-2021-43662 State: PUBLISHED Published: 2022-03-30T23:26:03 Last Updated: 2024-08-04T04:03:08.137Z Vendors: n/a Products: n/a Problem Types: n/a Description: totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chibataiki/iot-vuls/blob/main/totolink/dos.md
CVE ID: CVE-2021-43663 State: PUBLISHED Published: 2022-03-30T23:40:13 Last Updated: 2024-08-04T04:03:08.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chibataiki/iot-vuls/blob/main/totolink/command-injection1.md
CVE ID: CVE-2021-43664 State: PUBLISHED Published: 2022-03-30T22:53:59 Last Updated: 2024-08-04T04:03:08.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process&nbsp;forceugpo. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chibataiki/iot-vuls/blob/main/totolink/command-injection2.md
CVE ID: CVE-2021-43666 State: PUBLISHED Published: 2022-03-24T00:00:00.000Z Last Updated: 2025-11-03T19:26:30.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARMmbed/mbedtls/issues/5136 - https://lists.debian.org/debian-lts-announce/2022/12/msg00036.html
CVE ID: CVE-2021-43667 State: PUBLISHED Published: 2021-11-18T15:05:14 Last Updated: 2024-08-04T04:03:08.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash. Additional Analyst Notes: - CVE Program Container: References: - https://jira.hyperledger.org/browse/FAB-18529 - https://github.com/hyperledger/fabric/pull/2844
CVE ID: CVE-2021-43668 State: PUBLISHED Published: 2021-11-18T15:05:20 Last Updated: 2024-08-04T04:03:08.581Z Vendors: n/a Products: n/a Problem Types: n/a Description: Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ethereum/go-ethereum/issues/23866
CVE ID: CVE-2021-43669 State: PUBLISHED Published: 2021-11-18T15:05:27 Last Updated: 2024-08-04T04:03:08.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric. Additional Analyst Notes: - CVE Program Container: References: - https://jira.hyperledger.org/browse/FAB-18528 - https://github.com/hyperledger/fabric/pull/2828
CVE ID: CVE-2021-43673 State: PUBLISHED Published: 2021-12-03T11:36:13 Last Updated: 2024-08-04T04:03:08.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user via exit(json_encode($return)). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zyx0814/dzzoffice/issues/188
CVE ID: CVE-2021-43674 State: PUBLISHED Published: 2021-12-03T12:33:30 Last Updated: 2024-08-04T04:03:08.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ThinkUpLLC/ThinkUp/issues/2289
CVE ID: CVE-2021-43675 State: PUBLISHED Published: 2021-12-15T15:24:40 Last Updated: 2024-08-04T04:03:08.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LycheeOrg/Lychee - https://github.com/LycheeOrg/Lychee-v3 - https://github.com/LycheeOrg/LycheeOrg.github.io/blob/master/docs/releases.md#v3216
CVE ID: CVE-2021-43676 State: PUBLISHED Published: 2021-12-03T13:50:04 Last Updated: 2024-08-04T04:03:08.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matyhtf/framework/issues/206
CVE ID: CVE-2021-43677 State: PUBLISHED Published: 2022-01-04T19:10:41 Last Updated: 2024-08-04T04:03:08.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://fluxbb.com - https://github.com/fluxbb/fluxbb
CVE ID: CVE-2021-43678 State: PUBLISHED Published: 2021-12-17T12:49:17 Last Updated: 2024-08-04T04:03:08.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gaoming13/wechat-php-sdk - https://github.com/gaoming13/wechat-php-sdk/issues/30
CVE ID: CVE-2021-43679 State: PUBLISHED Published: 2021-12-02T14:13:59 Last Updated: 2024-08-04T04:03:08.680Z Vendors: n/a Products: n/a Problem Types: n/a Description: ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shopex/ecshop/issues/4
CVE ID: CVE-2021-43681 State: PUBLISHED Published: 2021-12-02T12:47:55 Last Updated: 2024-08-04T04:03:08.712Z Vendors: n/a Products: n/a Problem Types: n/a Description: SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and print the message $data['proxy_name']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ZeroDream-CN/SakuraPanel/issues/23
CVE ID: CVE-2021-43682 State: PUBLISHED Published: 2021-12-02T13:37:13 Last Updated: 2024-08-04T04:03:08.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER['HTTP_HOST']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/baijunyao/thinkphp-bjyblog/issues/6
CVE ID: CVE-2021-43683 State: PUBLISHED Published: 2021-12-02T12:36:56 Last Updated: 2024-08-04T04:03:08.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will terminate the script and print the message which has $_REQUEST['hash']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/HaschekSolutions/pictshare/issues/133
CVE ID: CVE-2021-43685 State: PUBLISHED Published: 2021-12-01T15:11:16 Last Updated: 2024-08-04T04:03:08.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/LibreTime/libretime/issues/1437
CVE ID: CVE-2021-43686 State: PUBLISHED Published: 2021-12-02T12:17:33 Last Updated: 2024-08-04T04:03:08.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $_GET['t']. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nZEDb/nZEDb/issues/2659
CVE ID: CVE-2021-43687 State: PUBLISHED Published: 2021-12-01T15:49:46 Last Updated: 2024-08-04T04:03:08.498Z Vendors: n/a Products: n/a Problem Types: n/a Description: chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie. Additional Analyst Notes: - CVE Program Container: References: - http://chamilo-lms.com - https://github.com/chamilo/chamilo-lms/blob/v1.11.14/plugin/jcapture/applet.php - https://github.com/chamilo/chamilo-lms/tree/v1.11.14 - https://support.chamilo.org/projects/chamilo-18/wiki/Security_issues#Issue-92-2021-11-12-Low-impact-Low-risk-XSS-Vulnerability-in-jCapture-
milo.org/projects/chamilo-18/wiki/Security_issues#Issue-92-2021-11-12-Low-impact-Low-risk-XSS-Vulnerability-in-jCapture-plugin-CVE-2021-43687
CVE ID: CVE-2021-43689 State: PUBLISHED Published: 2021-12-01T14:25:34 Last Updated: 2024-08-04T04:03:08.519Z Vendors: n/a Products: n/a Problem Types: n/a Description: manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.class.php. The exit function will terminate the script and print a message which have values from $_POST. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yicenburan/manage/issues/2
CVE ID: CVE-2021-43690 State: PUBLISHED Published: 2021-12-01T12:27:00 Last Updated: 2024-08-04T04:03:08.616Z Vendors: n/a Products: n/a Problem Types: n/a Description: YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. The exit function will terminate the script and print a message which have values from the socket_read. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Yurunsoft/YurunProxy/issues/3
CVE ID: CVE-2021-43691 State: PUBLISHED Published: 2021-11-29T15:04:21 Last Updated: 2024-08-04T04:03:08.632Z Vendors: n/a Products: n/a Problem Types: n/a Description: tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"] then there is a path manipulation vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/toocool/tripexpress/issues/40
CVE ID: CVE-2021-43692 State: PUBLISHED Published: 2021-11-29T14:27:44 Last Updated: 2024-08-04T04:03:08.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zxq2233/youtube-php-mirroring/issues/3
CVE ID: CVE-2021-43693 State: PUBLISHED Published: 2021-11-29T14:13:40 Last Updated: 2024-08-04T04:03:08.437Z Vendors: n/a Products: n/a Problem Types: n/a Description: vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/serghey-rodin/vesta/issues/2052
CVE ID: CVE-2021-43695 State: PUBLISHED Published: 2021-11-29T13:34:03 Last Updated: 2024-08-04T04:03:08.438Z Vendors: n/a Products: n/a Problem Types: n/a Description: issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST without sanitization, then there is a XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IssabelFoundation/issabelPBX/issues/33
CVE ID: CVE-2021-43696 State: PUBLISHED Published: 2021-11-29T12:52:24 Last Updated: 2024-08-04T04:03:08.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST then there is a XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/happyman/twmap/issues/57
CVE ID: CVE-2021-43697 State: PUBLISHED Published: 2021-11-29T12:25:33 Last Updated: 2024-08-04T04:03:08.628Z Vendors: n/a Products: n/a Problem Types: n/a Description: Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/happyliu2014/Workerman-ThinkPHP-Redis/issues/1
CVE ID: CVE-2021-43698 State: PUBLISHED Published: 2021-11-29T11:33:36 Last Updated: 2024-08-04T04:03:08.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET['query'] then there is a XSS vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sparc/phpWhois.org/issues/21
CVE ID: CVE-2021-43700 State: PUBLISHED Published: 2022-03-24T12:58:28 Last Updated: 2024-08-04T04:03:08.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gongwalker/ApiManager/issues/26
CVE ID: CVE-2021-43701 State: PUBLISHED Published: 2022-03-29T15:31:16 Last Updated: 2024-08-04T04:03:08.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cskaza/cszcms/issues/31 - https://www.exploit-db.com/exploits/50846 - http://packetstormsecurity.com/files/166535/CSZ-CMS-1.2.9-SQL-Injection.html
CVE ID: CVE-2021-43702 State: PUBLISHED Published: 2022-07-05T11:50:03 Last Updated: 2024-08-04T04:03:08.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.asus.com/uk/Networking-IoT-Servers/WiFi-Routers/ASUS-WiFi-Routers/RT-AC88U/ - https://www.kroll.com/en/insights/publications/cyber/cve-2021-43702-from-discovery-to-patch
CVE ID: CVE-2021-43703 State: PUBLISHED Published: 2021-12-09T16:38:40 Last Updated: 2024-08-04T04:03:08.813Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/forget-code/zzcms/issues/1
CVE ID: CVE-2021-43707 State: PUBLISHED Published: 2022-03-31T19:14:29 Last Updated: 2024-08-04T04:03:08.687Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/maccmspro/maccms10/issues/18
CVE ID: CVE-2021-43708 State: PUBLISHED Published: 2022-04-21T18:12:56 Last Updated: 2024-08-04T04:03:08.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the generation of a classification label by using Excel's safe mode. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40way2goraj/bypass-data-classification-labelling-tool-aa037ff86dee
CVE ID: CVE-2021-43711 State: PUBLISHED Published: 2022-01-04T13:49:47 Last Updated: 2024-08-04T04:03:08.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for unauthenticated command execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/doudoudedi/ToTolink_EX200_Cmmand_Execute/blob/main/ToTolink%20EX200%20Comand%20Injection2.md
CVE ID: CVE-2021-43712 State: PUBLISHED Published: 2022-05-09T20:58:43 Last Updated: 2024-08-04T04:03:08.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field. Additional Analyst Notes: - CVE Program Container: References: - http://employee.com - http://sourcecodester.com - https://patelvarshil.medium.com/cve-2021-43712-stored-xss-how-i-got-my-first-cve-5381370482d4
CVE ID: CVE-2021-43721 State: PUBLISHED Published: 2022-03-28T13:37:04 Last Updated: 2024-08-04T04:03:08.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();> Additional Analyst Notes: - CVE Program Container: References: - https://github.com/leanote/desktop-app/issues/364
CVE ID: CVE-2021-43722 State: PUBLISHED Published: 2022-03-31T20:28:00 Last Updated: 2024-08-04T04:03:08.651Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack and has no limit on the size. Additional Analyst Notes: - CVE Program Container: References: - https://www.dlink.com/en/security-bulletin/ - https://github.com/luqiut/iot/blob/main/DIR-645%20Stack%20overflow.md
CVE ID: CVE-2021-43724 State: PUBLISHED Published: 2022-02-23T18:31:30 Last Updated: 2024-08-04T04:03:08.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/intelliants/subrion/issues/890
CVE ID: CVE-2021-43725 State: PUBLISHED Published: 2022-03-28T12:52:07 Last Updated: 2024-08-04T04:03:08.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/spotweb/spotweb/issues/718 - https://github.com/spotweb/spotweb/commit/2bfa001689aae96009688a193c64478647ba45a1
CVE ID: CVE-2021-43728 State: PUBLISHED Published: 2022-05-20T14:51:49 Last Updated: 2024-08-04T04:03:08.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized SSID parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.pix-link.com/page50?product_id=144 - https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990
CVE ID: CVE-2021-43729 State: PUBLISHED Published: 2022-05-20T14:51:08 Last Updated: 2024-08-04T04:03:08.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized Security Key parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.pix-link.com/page50?product_id=144 - https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990
CVE ID: CVE-2021-43734 State: PUBLISHED Published: 2022-02-15T13:21:39 Last Updated: 2024-08-04T04:03:08.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kekingcn/kkFileView/issues/304
CVE ID: CVE-2021-43735 State: PUBLISHED Published: 2022-03-23T15:17:33 Last Updated: 2024-08-04T04:03:08.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/arterli/CmsWing/issues/55
CVE ID: CVE-2021-43736 State: PUBLISHED Published: 2022-03-23T15:21:25 Last Updated: 2024-08-04T04:03:08.627Z Vendors: n/a Products: n/a Problem Types: n/a Description: CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule Additional Analyst Notes: - CVE Program Container: References: - https://github.com/arterli/CmsWing/issues/56
CVE ID: CVE-2021-43737 State: PUBLISHED Published: 2022-03-23T16:03:38 Last Updated: 2024-08-04T04:03:08.844Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hiliqi/xiaohuanxiong/issues/28
CVE ID: CVE-2021-43738 State: PUBLISHED Published: 2022-03-23T16:00:17 Last Updated: 2024-08-04T04:03:08.812Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrator account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hiliqi/xiaohuanxiong/issues/28