Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-43077 State: PUBLISHED Published: 2022-03-01T18:30:11 Last Updated: 2024-10-25T13:34:46.320Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C) Vendors: Fortinet Products: Fortinet FortiWLM Problem Types: Execute unauthorized code or commands Description: A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.2 and below, version 8.5.2 and below, version 8.4.2 and below, version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the AP monitor handlers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
ed HTTP requests to the AP monitor handlers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/advisory/FG-IR-21-189
CVE ID: CVE-2021-43078 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:18.449Z Description: No description available.
CVE ID: CVE-2021-43079 State: REJECTED Published: N/A Last Updated: 2025-03-17T22:38:17.990Z Description: No description available.
CVE ID: CVE-2021-43080 State: PUBLISHED Published: 2022-09-06T15:15:23 Last Updated: 2024-10-22T20:54:00.161Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:F/RL:X/RC:X) Vendors: Fortinet Products: Fortinet FortiOS Problem Types: Execute unauthorized code or commands Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors. Additional Analyst Notes
RI parameter via the Threat Feed IP address section of the Security Fabric External connectors. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-222
CVE ID: CVE-2021-43081 State: PUBLISHED Published: 2022-05-11T14:30:18 Last Updated: 2024-10-22T20:57:08.663Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:X/RL:W/RC:X) Vendors: Fortinet Products: Fortinet FortiProxy Problem Types: Unauthorized code execution Description: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Containe
icated attacker to perform an XSS attack via crafted HTTP GET requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-230
CVE ID: CVE-2021-43082 State: PUBLISHED Published: 2021-11-03T15:20:27 Last Updated: 2024-08-04T03:47:13.379Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-120 Description: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in the stats-over-http plugin of Apache Traffic Server allows an attacker to overwrite memory. This issue affects Apache Traffic Server 9.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/k01797hyncx53659wr3o72s5cvkc3164
CVE ID: CVE-2021-43083 State: PUBLISHED Published: 2021-12-19T08:25:09 Last Updated: 2024-08-04T03:47:13.291Z Vendors: Apache Software Foundation Products: Apache PLC4X Problem Types: CWE-119, CWE-191 Description: Apache PLC4X - PLC4C (Only the C language implementation was effected) was vulnerable to an unsigned integer underflow flaw inside the tcp transport. Users should update to 0.9.1, which addresses this issue. However, in order to exploit this vulnerability, a user would have to actively connect to a mallicious device which could send a response with invalid content. Currently we consider the probability of this being exploited as quite minimal, however this could change in the futur
. Currently we consider the probability of this being exploited as quite minimal, however this could change in the future, especially with the industrial networks growing more and more together. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/jxx6qc84z60xbbhn6vp2s5qf09psrtc7 - http://www.openwall.com/lists/oss-security/2021/12/20/2
CVE ID: CVE-2021-43084 State: PUBLISHED Published: 2022-03-24T17:13:01 Last Updated: 2024-08-04T03:47:13.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Dreamer CMS 4.0.0 via the tableName parameter. Additional Analyst Notes: - CVE Program Container: References: - https://gitee.com/isoftforce/dreamer_cms/issues/I4F93V
CVE ID: CVE-2021-43085 State: REJECTED Published: 2022-03-24T17:43:30 Last Updated: 2022-03-30T13:09:57 Description: No description available.
CVE ID: CVE-2021-43086 State: PUBLISHED Published: 2022-02-28T14:06:31 Last Updated: 2024-08-04T03:47:13.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl option was used, a stack-buffer-overflow occurred in function encode_ise() in function compress_symbolic_block_for_partition_2planes() in "/Source/astcenc_compress_symbolic.cpp". Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ARM-software/astc-encoder/issues/296.
CVE ID: CVE-2021-43090 State: PUBLISHED Published: 2022-03-25T15:47:12 Last Updated: 2024-08-04T03:47:13.557Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability exists in soa-model before 1.6.4 in the WSDLParser function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/membrane/soa-model/issues/281 - https://github.com/membrane/soa-model/commit/3aa295f155f621d5ea661cb9a0604013fc8fd8ff - https://github.com/membrane/soa-model/commit/19de16902468e7963cc4dc6b544574bc1ea3f251 - https://github.com/membrane/soa-model/releases/tag/v1.6.4
CVE ID: CVE-2021-43091 State: PUBLISHED Published: 2022-03-25T16:14:57 Last Updated: 2024-08-04T03:47:13.504Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/07f245a7-ee9f-4b55-a0cc-13d5cb1be6e0/ - https://github.com/yeswiki/yeswiki/commit/c9785f9a92744c3475f9676a0d8f95de24750094
CVE ID: CVE-2021-43094 State: PUBLISHED Published: 2022-05-10T11:40:48 Last Updated: 2024-08-04T03:47:13.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in OpenMRS Reference Application Standalone Edition <=2.11 and Platform Standalone Edition <=2.4.0 via GET requests on arbitrary parameters in patient.page. Additional Analyst Notes: - CVE Program Container: References: - https://wiki.openmrs.org/display/docs/Reporting+Bugs - https://openmrs.org/demo/ - https://issues.openmrs.org/browse/TRUNK-6043
CVE ID: CVE-2021-43097 State: PUBLISHED Published: 2022-03-28T21:02:42 Last Updated: 2024-08-04T03:47:13.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-side Template Injection (SSTI) vulnerability exists in bbs 5.3 in TemplateManageAction.javawhich could let a malicoius user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43098 State: PUBLISHED Published: 2022-03-28T21:06:23 Last Updated: 2024-08-04T03:47:13.592Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43099 State: PUBLISHED Published: 2022-03-28T21:16:14 Last Updated: 2024-08-04T03:47:13.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Archive Extraction (AKA "Zip Slip) vulnerability exists in bbs 5.3 in the UpgradeNow function in UpgradeManageAction.java, which unzips the arbitrary upladed zip file without checking filenames. The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43100 State: PUBLISHED Published: 2022-03-28T21:19:55 Last Updated: 2024-08-04T03:47:13.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43101 State: PUBLISHED Published: 2022-03-28T21:22:23 Last Updated: 2024-08-04T03:47:13.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43102 State: PUBLISHED Published: 2022-03-28T21:25:37 Last Updated: 2024-08-04T03:47:13.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43103 State: PUBLISHED Published: 2022-03-28T21:28:44 Last Updated: 2024-08-04T03:47:13.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function, which lets a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/diyhi/bbs/issues/51
CVE ID: CVE-2021-43105 State: PUBLISHED Published: 2022-03-28T22:02:34 Last Updated: 2024-08-04T03:47:13.577Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability in the bailiwick checking function in Technitium DNS Server <= v7.0 exists that allows specific malicious users to inject `NS` records of any domain (even TLDs) into the cache and conduct a DNS cache poisoning attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TechnitiumSoftware/DnsServer/blob/master/CHANGELOG.md
CVE ID: CVE-2021-43106 State: PUBLISHED Published: 2022-02-14T19:48:07 Last Updated: 2024-08-04T03:47:13.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. This is due to that the server implicitly trusts the Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to
he Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to a malicious domain/web page. This would result in expanding the potential to further attacks and malicious actions. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/IthacaLabs/CompassPlus/tree/main/TranzWare%20Online%20FIMI_Version%204.2.19.4%2025_HHI
CVE ID: CVE-2021-43109 State: PUBLISHED Published: 2022-03-29T17:33:44 Last Updated: 2024-08-04T03:47:13.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PuneethReddyHC/online-shopping-system/issues/17
CVE ID: CVE-2021-43110 State: PUBLISHED Published: 2022-03-29T17:40:03 Last Updated: 2024-08-04T03:47:13.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PuneethReddyHC/online-shopping-system/issues/17
CVE ID: CVE-2021-43113 State: PUBLISHED Published: 2021-12-15T00:00:00 Last Updated: 2024-08-04T03:47:13.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: iTextPDF in iText 7 and up to (excluding 4.4.13.3) 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/itext/itext7/releases/tag/7.1.17 - https://pastebin.com/BXnkY9YY - https://lists.debian.org/debian-lts-announce/2023/01/msg00013.html - https://www.debian.org/security/2023/dsa-5323 - https://github.com/itext/itextpdf/releases/tag/5.5.13.3
CVE ID: CVE-2021-43114 State: PUBLISHED Published: 2021-11-09T00:00:00 Last Updated: 2024-10-15T20:27:11.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/NICMx/FORT-validator/releases/tag/1.5.2 - https://www.debian.org/security/2021/dsa-5033 - https://github.com/NICMx/FORT-validator/commit/425e0f4037b4543fe8044ac96ca71d6d02d7d8c5 - https
security/2021/dsa-5033 - https://github.com/NICMx/FORT-validator/commit/425e0f4037b4543fe8044ac96ca71d6d02d7d8c5 - https://github.com/NICMx/FORT-validator/commit/673c679b6bf3f4187cd5242c31a795bf8a6c22b3 - https://github.com/NICMx/FORT-validator/commit/eb68ebbaab50f3365aa51bbaa17cb862bf4607fa - https://github.com/NICMx/FORT-validator/commit/274dc14aed1eb9b3350029d1063578a6b9c77b54
CVE ID: CVE-2021-43116 State: PUBLISHED Published: 2022-07-05T00:00:00 Last Updated: 2024-08-04T03:47:13.593Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/alibaba/nacos/issues/7127 - https://github.com/alibaba/nacos/issues/7182 - http://packetstormsecurity.com/files/171638/Nacos-2.0.3-Access-Control.html
CVE ID: CVE-2021-43117 State: PUBLISHED Published: 2021-12-13T11:31:35 Last Updated: 2024-08-04T03:47:13.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ambitiousleader/some-automated-script/issues/1
CVE ID: CVE-2021-43118 State: PUBLISHED Published: 2022-03-29T19:37:57 Last Updated: 2024-08-04T03:47:13.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/Cossack9989/6034c077f46e4f06d0992e9f2fae7f26
CVE ID: CVE-2021-43129 State: PUBLISHED Published: 2022-04-19T12:08:30 Last Updated: 2024-08-04T03:47:13.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access print and copy functionality via the browser’s right click menu even when “Disable Right Click” is enabled on the quiz. Additional Analyst Notes: - CVE Program Container: References: - https://www.d2l.com/learning-management-system-lms/ - https://github.com/Skotizo/CVE-2021-43129 - https://community.brightspace.com/s/article/retirement-notice-disable-right-click
CVE ID: CVE-2021-43130 State: PUBLISHED Published: 2021-11-03T14:52:38 Last Updated: 2024-08-04T03:47:13.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50158 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-43130
CVE ID: CVE-2021-43136 State: PUBLISHED Published: 2021-11-10T11:09:18 Last Updated: 2024-08-04T03:47:13.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform. Additional Analyst Notes: - CVE Program Container: References: - https://blog.hacktivesecurity.com - https://formalms.org - https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/ - http://packetstormsecurity.com/files/164930/FormaLMS-2.4.4-Authentication-Bypass.html
CVE ID: CVE-2021-43137 State: PUBLISHED Published: 2021-12-01T19:14:50 Last Updated: 2024-08-04T03:47:13.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50461
CVE ID: CVE-2021-43138 State: PUBLISHED Published: 2022-04-06T00:00:00 Last Updated: 2024-08-04T03:47:13.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/caolan/async/blob/master/lib/internal/iterator.js - https://github.com/caolan/async/blob/master/lib/mapValuesLimit.js - https://jsfiddle.net/oz5twjd9/ - https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d - https://github.com/caolan/asyn
wjd9/ - https://github.com/caolan/async/commit/e1ecdbf79264f9ab488c7799f4c76996d5dca66d - https://github.com/caolan/async/blob/v2.6.4/CHANGELOG.md#v264 - https://github.com/caolan/async/pull/1828 - https://github.com/caolan/async/compare/v2.6.3...v2.6.4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTEUUTNIEBHGKUKKLNUZSV7IEP6IP3Q3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UM6XJ73Q3NAM5KSGCOKJ2ZIA6GUWUJLK/ - https://security.netapp.com/advisory/ntap-20240621-0006/
CVE ID: CVE-2021-43140 State: PUBLISHED Published: 2021-11-03T18:38:33 Last Updated: 2024-08-04T03:47:13.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability exists in Sourcecodester. Simple Subscription Website 1.0. via the login. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dir0x/CVE-2021-43140 - http://packetstormsecurity.com/files/164968/Simple-Subscription-Website-1.0-SQL-Injection.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-43140
CVE ID: CVE-2021-43141 State: PUBLISHED Published: 2021-11-03T18:40:38 Last Updated: 2024-08-04T03:47:13.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Simple Subscription Website 1.0 via the id parameter in plan_application. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Dir0x/CVE-2021-43141 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-43141 - https://www.nu11secur1ty.com/2021/11/cve-2021-43141.html - https://streamable.com/8gydfs
CVE ID: CVE-2021-43142 State: PUBLISHED Published: 2022-03-30T21:05:37 Last Updated: 2024-08-04T03:47:13.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput. Additional Analyst Notes: - CVE Program Container: References: - https://novysodope.github.io/2021/10/29/64/
CVE ID: CVE-2021-43145 State: PUBLISHED Published: 2022-02-04T14:23:30 Last Updated: 2024-08-04T03:47:13.534Z Vendors: n/a Products: n/a Problem Types: n/a Description: With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts. Additional Analyst Notes: - CVE Program Container: References: - https://zammad.com/de/advisories/zaa-2021-20
CVE ID: CVE-2021-43149 State: REJECTED Published: 2022-04-08T20:06:38 Last Updated: 2022-04-08T20:06:38 Description: No description available.
CVE ID: CVE-2021-43154 State: PUBLISHED Published: 2022-04-13T22:20:22 Last Updated: 2024-08-04T03:47:13.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php. Additional Analyst Notes: - CVE Program Container: References: - https://elprofesor.me/2021/10/24/stored-cross-site-scripting-via-m1-name-authenticated
CVE ID: CVE-2021-43155 State: PUBLISHED Published: 2021-12-22T17:24:57 Last Updated: 2024-08-04T03:47:13.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/18
CVE ID: CVE-2021-43156 State: PUBLISHED Published: 2021-12-22T17:22:27 Last Updated: 2024-08-04T03:47:13.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/projectworldsofficial/online-book-store-project-in-php/issues/19
CVE ID: CVE-2021-43157 State: PUBLISHED Published: 2021-12-22T17:28:20 Last Updated: 2024-08-04T03:47:13.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Projectsworlds Online Shopping System PHP 1.0 is vulnerable to SQL injection via the id parameter in cart_remove.php. Additional Analyst Notes: - CVE Program Container: References: - https://projectworlds.in/free-projects/php-projects/free-download-online-shopping-system/ - https://github.com/projectworldsofficial/online-shopping-webvsite-in-php/issues/1