Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
21/10/05 ) and later Multimedia Console 1.5.3 ( 2021/10/05 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-45
CVE ID: CVE-2021-38685 State: PUBLISHED Published: 2021-11-26T14:00:13.130255Z Last Updated: 2024-09-17T02:46:41.057Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-78 Description: A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-51
CVE ID: CVE-2021-38686 State: PUBLISHED Published: 2021-11-26T14:00:14.527222Z Last Updated: 2024-09-16T20:16:15.429Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows attackers to compromise the security of the system. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-52
CVE ID: CVE-2021-38687 State: PUBLISHED Published: 2021-12-29T13:05:14.828504Z Last Updated: 2024-09-16T20:22:38.263Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Surveillance Station Problem Types: CWE-120 Description: A stack buffer overflow vulnerability has been reported to affect QNAP NAS running Surveillance Station. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of Surveillance Station: QTS 5.0.0 (64 bit): Surveillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) a
veillance Station 5.2.0.4.2 ( 2021/10/26 ) and later QTS 5.0.0 (32 bit): Surveillance Station 5.2.0.3.2 ( 2021/10/26 ) and later QTS 4.3.6 (64 bit): Surveillance Station 5.1.5.4.6 ( 2021/10/26 ) and later QTS 4.3.6 (32 bit): Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later QTS 4.3.3: Surveillance Station 5.1.5.3.6 ( 2021/10/26 ) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-46
CVE ID: CVE-2021-38688 State: PUBLISHED Published: 2021-12-29T13:05:16.235795Z Last Updated: 2024-09-16T22:20:30.715Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: Qfile Problem Types: CWE-287 Description: An improper authentication vulnerability has been reported to affect Android App Qfile. If exploited, this vulnerability allows attackers to compromise app and access information We have already fixed this vulnerability in the following versions of Qfile: Qfile 3.0.0.1105 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-55
CVE ID: CVE-2021-38689 State: PUBLISHED Published: 2022-01-14T01:00:20.676529Z Last Updated: 2024-09-17T00:50:59.370Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Elite, QVR Pro, QVR Guard Problem Types: CWE-120 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and l
Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and later QTS 4.5.4: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Pro 2.1.3.0 (2021/12/06) and later QTS 4.5.4: QVR Guard 2.1.3.0 (2021/12/06) and later QTS 5.0.0: QVR Guard 2.1.3.0 (2021/12/06) and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-21-59
CVE ID: CVE-2021-38690 State: PUBLISHED Published: 2022-01-14T01:00:22.078050Z Last Updated: 2024-09-16T22:20:56.127Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Elite, QVR Pro, QVR Guard Problem Types: CWE-120 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and l
CVE ID: CVE-2021-38691 State: PUBLISHED Published: 2022-01-14T01:00:23.562025Z Last Updated: 2024-09-17T04:03:46.241Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Elite, QVR Pro, QVR Guard Problem Types: CWE-120 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and l
CVE ID: CVE-2021-38692 State: PUBLISHED Published: 2022-01-14T01:00:24.925297Z Last Updated: 2024-09-16T23:26:39.956Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: QNAP Systems Inc. Products: QVR Elite, QVR Pro, QVR Guard Problem Types: CWE-120 Description: A stack buffer overflow vulnerability has been reported to affect QNAP device running QVR Elite, QVR Pro, QVR Guard. If exploited, this vulnerability allows attackers to execute arbitrary code. We have already fixed this vulnerability in the following versions of QVR Elite, QVR Pro, QVR Guard: QuTS hero h5.0.0: QVR Elite 2.1.4.0 (2021/12/06) and later QuTS hero h4.5.4: QVR Elite 2.1.4.0 (2021/12/06) and l
CVE ID: CVE-2021-38693 State: PUBLISHED Published: 2022-05-05T16:50:19.054852Z Last Updated: 2024-09-16T18:08:15.851Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: QNAP Systems Inc. Products: QuTScloud, QuTS hero, QTS Problem Types: CWE-22 Description: A path traversal vulnerability has been reported to affect QNAP device running QuTScloud, QuTS hero, QTS, QVR Pro Appliance. If exploited, this vulnerability allows attackers to read the contents of unexpected files and expose sensitive data. We have already fixed this vulnerability in the following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.194
following versions of QuTScloud, QuTS hero, QTS, QVR Pro Appliance: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1949 build 20220215 and later QuTS hero h4.5.4.1951 build 20220218 and later QTS 5.0.0.1986 build 20220324 and later QTS 4.5.4.1991 build 20220329 and later Additional Analyst Notes: - CVE Program Container: References: - https://www.qnap.com/en/security-advisory/qsa-22-13
CVE ID: CVE-2021-38694 State: PUBLISHED Published: 2022-01-18T14:00:31 Last Updated: 2024-08-04T01:51:19.633Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftVibe SARABAN for INFOMA 1.1 allows SQL Injection. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US - https://orangeo.tech/post/2021/12/24/First-CVEs.html - https://sawatdee.github.io/post/2021/12/24/First-CVEs.html - http://www.infoma.net/index.php/saraban/
CVE ID: CVE-2021-38695 State: PUBLISHED Published: 2022-01-18T14:05:18 Last Updated: 2024-08-04T01:51:19.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US - https://orangeo.tech/post/2021/12/24/First-CVEs.html - https://sawatdee.github.io/post/2021/12/24/First-CVEs.html - http://www.infoma.net/index.php/saraban/
CVE ID: CVE-2021-38696 State: PUBLISHED Published: 2022-01-18T14:11:13 Last Updated: 2024-08-04T01:51:19.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftVibe SARABAN for INFOMA 1.1 has Incorrect Access Control vulnerability, that allows attackers to access signature files on the application without any authentication. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US - https://orangeo.tech/post/2021/12/24/First-CVEs.html - https://sawatdee.github.io/post/2021/12/24/First-CVEs.html - http://www.infoma.net/index.php/saraban/
CVE ID: CVE-2021-38697 State: PUBLISHED Published: 2022-01-18T14:13:59 Last Updated: 2024-08-04T01:51:19.709Z Vendors: n/a Products: n/a Problem Types: n/a Description: SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which can lead to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://play.google.com/store/apps/details?id=th.co.softvibe.saraban&hl=en&gl=US - https://orangeo.tech/post/2021/12/24/First-CVEs.html - https://sawatdee.github.io/post/2021/12/24/First-CVEs.html - http://www.infoma.net/index.php/saraban/
CVE ID: CVE-2021-38698 State: PUBLISHED Published: 2021-09-07T11:45:14 Last Updated: 2024-08-04T01:51:19.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.hashicorp.com/blog/category/consul - https://discuss.hashicorp.com/t/hcsec-2021-24-consul-missing-authorization-check-on-txn-apply-endpoint/29026 - https://security.gentoo.org/glsa/202208-09
CVE ID: CVE-2021-38699 State: PUBLISHED Published: 2021-08-15T17:32:36 Last Updated: 2024-08-04T01:51:19.732Z Vendors: n/a Products: n/a Problem Types: n/a Description: TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs. Additional Analyst Notes: - CVE Program Container: References: - https://tastyigniter.com/support - https://github.com/Justin-1993/CVE-2021-38699 - https://pentesternotes.com/?p=209 - http://packetstormsecurity.com/files/163843/TastyIgniter-3.0.7-Cross-Site-Scripting.html - https://github.com/HuskyHacks/CVE-2021-38699-Reflected-XSS - https://github.com/HuskyHacks/CVE-2021-38699-Stored-XSS
CVE ID: CVE-2021-38701 State: PUBLISHED Published: 2021-12-15T06:53:15 Last Updated: 2024-08-04T01:51:19.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0.86; T205 before 4.12.0.62; T204 before 3.28.0.166; and T100, T101, T102, and T103 before 2.6.0.180. Additional Analyst Notes: - CVE Program Container: References: - https://www.motorolasolutions.com/en_us/about/trust-center/security.html - https://support.avigilon.com/s/feed/0D54y00006l9eCMCAY
CVE ID: CVE-2021-38702 State: PUBLISHED Published: 2021-08-17T19:28:16 Last Updated: 2024-08-04T01:51:20.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks. Additional Analyst Notes: - CVE Program Container: References: - http://www.cyberoamworks.com/NetGenie-Home.asp - http://seclists.org/fulldisclosure/2021/Aug/20 - http://packetstormsecurity.com/files/163859/Cyberoam-NetGenie-Cross-Site-Scripting.html - https://seclists.org/fulldisclosure/2021/Aug/20
CVE ID: CVE-2021-38703 State: PUBLISHED Published: 2021-09-01T11:15:22 Last Updated: 2024-08-04T01:51:19.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090. Additional Analyst Notes: - CVE Program Container: References: - https://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2 - https://7bits.nl/journal/posts/cve-2021-38703-kpn-exp
tps://www.kpnwebshop.com/modems-routers/producten/experia-wifi/2 - https://7bits.nl/journal/posts/cve-2021-38703-kpn-experia-wifi-root-shell/
CVE ID: CVE-2021-38704 State: PUBLISHED Published: 2021-09-07T19:21:49 Last Updated: 2024-08-04T01:51:19.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/judsonmitchell/ClinicCases/releases - https://github.com/sudonoodle/CVE-2021-38704
CVE ID: CVE-2021-38705 State: PUBLISHED Published: 2021-09-07T19:25:03 Last Updated: 2024-08-04T01:51:19.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: ClinicCases 7.3.3 is affected by Cross-Site Request Forgery (CSRF). A successful attack would consist of an authenticated user following a malicious link, resulting in arbitrary actions being carried out with the privilege level of the targeted user. This can be exploited to create a secondary administrator account for the attacker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/judsonmitchell/ClinicCases/releases - https://github.com/sudonoodle/CVE-2021-38705
CVE ID: CVE-2021-38706 State: PUBLISHED Published: 2021-09-07T19:13:15 Last Updated: 2024-08-04T01:51:19.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: messages_load.php in ClinicCases 7.3.3 suffers from a blind SQL injection vulnerability, which allows low-privileged attackers to execute arbitrary SQL commands through a vulnerable parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/judsonmitchell/ClinicCases/releases - https://cliniccases.com
CVE ID: CVE-2021-38707 State: PUBLISHED Published: 2021-09-07T19:16:29 Last Updated: 2024-08-04T01:51:19.981Z Vendors: n/a Products: n/a Problem Types: n/a Description: Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/judsonmitchell/ClinicCases/releases - https://github.com/sudonoodle/CVE-2021-38707
CVE ID: CVE-2021-38708 State: PUBLISHED Published: 2021-08-16T02:40:06 Last Updated: 2024-08-04T01:51:19.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS. Additional Analyst Notes: - CVE Program Container: References: - https://compo.sr/news/view/announcements/two-new-xss-security.htm
CVE ID: CVE-2021-38709 State: PUBLISHED Published: 2021-08-16T02:39:55 Last Updated: 2024-08-04T01:51:19.982Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS. Additional Analyst Notes: - CVE Program Container: References: - https://compo.sr/news/view/announcements/two-new-xss-security.htm
CVE ID: CVE-2021-38710 State: PUBLISHED Published: 2021-08-18T14:41:18 Last Updated: 2024-08-04T01:51:19.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITE_NAME parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/security-n/CVE-2021-38710
CVE ID: CVE-2021-38711 State: PUBLISHED Published: 2021-08-16T03:18:14 Last Updated: 2024-08-04T01:51:19.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgm/gitit/compare/0.14.0.0...0.15.0.0 - https://github.com/jgm/gitit/commit/eed32638f4f6e3b2f4b8a9a04c4b72001acf9ad8
CVE ID: CVE-2021-38712 State: PUBLISHED Published: 2021-08-16T03:35:45 Last Updated: 2024-08-04T01:51:19.979Z Vendors: n/a Products: n/a Problem Types: n/a Description: OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to block the access via an NGINX configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helloxz/onenav/issues/25
CVE ID: CVE-2021-38713 State: PUBLISHED Published: 2021-08-16T03:35:34 Last Updated: 2024-08-04T01:51:19.951Z Vendors: n/a Products: n/a Problem Types: n/a Description: imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/helloxz/imgurl/issues/72
CVE ID: CVE-2021-38714 State: PUBLISHED Published: 2021-08-24T13:57:43 Last Updated: 2024-08-04T01:51:20.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/plib/bugs/55/ - https://lists.debian.org/debian-lts-announce/2021/10/msg00000.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OTVSAKNCEYVMVAURQSB5GNA2MWL4XDPH/ - https://lists.fedoraprojec
s/list/package-announce%40lists.fedoraproject.org/message/OTVSAKNCEYVMVAURQSB5GNA2MWL4XDPH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7HT3BKNAXLDY246UPUNRSBPGGVANRDOU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U5SML6W6Z2B6THT76VPUKUFYQJABODFU/
CVE ID: CVE-2021-38721 State: PUBLISHED Published: 2021-09-09T14:35:37 Last Updated: 2024-08-04T01:51:19.970Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.5.0 login.php contains a cross-site request forgery (CSRF) vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/584 - https://github.com/daylightstudio/FUEL-CMS/commit/6164cd794674d4d74da39f8b535ff588ab006e33
CVE ID: CVE-2021-38723 State: PUBLISHED Published: 2021-09-09T14:33:49 Last Updated: 2024-08-04T01:51:19.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/583
CVE ID: CVE-2021-38725 State: PUBLISHED Published: 2021-09-09T14:30:16 Last Updated: 2024-08-04T01:51:20.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fuel CMS 1.5.0 has a brute force vulnerability in fuel/modules/fuel/controllers/Login.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/581 - https://github.com/daylightstudio/FUEL-CMS/commit/15934fdd309408640d1f2be18f93a8beadaa5e9b
CVE ID: CVE-2021-38727 State: PUBLISHED Published: 2021-09-09T15:14:08 Last Updated: 2024-08-04T01:51:19.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/logs/items Additional Analyst Notes: - CVE Program Container: References: - https://github.com/daylightstudio/FUEL-CMS/issues/582 - https://www.nu11secur1ty.com/2021/10/cve-2021-38727.html - https://streamable.com/lxw3ln
CVE ID: CVE-2021-38728 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T13:23:40.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS SHOP v 1.1 is vulnerable to Cross Site Scripting (XSS) via Ant_M_Coup.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sem-cms.cn/wenda/view-56.html - https://github.com/BigTiger2020/SCSHOP/blob/main/semcms-9.md
CVE ID: CVE-2021-38729 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T16:16:47.480Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Plist.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sem-cms.cn/wenda/view-56.html - https://github.com/BigTiger2020/SCSHOP/blob/main/semcms-5.md
CVE ID: CVE-2021-38730 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T16:16:17.794Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Info.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sem-cms.cn/wenda/view-56.html - https://github.com/BigTiger2020/SCSHOP/blob/main/semcms-8.md
CVE ID: CVE-2021-38731 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T16:15:40.365Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_Zekou.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sem-cms.cn/wenda/view-56.html - https://github.com/BigTiger2020/SCSHOP/blob/main/semcms-4.md
CVE ID: CVE-2021-38732 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T16:15:13.357Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS SHOP v 1.1 is vulnerable to SQL via Ant_Message.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sem-cms.cn/wenda/view-56.html - https://github.com/BigTiger2020/SCSHOP/blob/main/semcms-3.md
CVE ID: CVE-2021-38733 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T16:14:41.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS SHOP v 1.1 is vulnerable to SQL Injection via Ant_BlogCat.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sem-cms.cn/wenda/view-56.html - https://github.com/BigTiger2020/SCSHOP/blob/main/semcms-7.md