Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-25839 State: PUBLISHED Published: 2021-04-26T13:30:43 Last Updated: 2024-08-03T20:11:28.462Z Vendors: n/a Products: n/a Problem Types: n/a Description: A weak password requirement vulnerability exists in the Create New User function of MintHCM RELEASE 3.0.8, which could lead an attacker to easier password brute-forcing. Additional Analyst Notes: - CVE Program Container: References: - https://minthcm.org/ - https://github.com/C1inton/CVE-Record/blob/master/CVE%20Record/%5BCVE-2021-25839%5DMintHCM%203.0.8.md
CVE ID: CVE-2021-25845 State: PUBLISHED Published: 2021-05-10T10:52:19 Last Updated: 2024-08-03T20:11:28.410Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a NULL pointer dereference via a crafted lldp packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/ - https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities
CVE ID: CVE-2021-25846 State: PUBLISHED Published: 2021-05-10T10:52:25 Last Updated: 2024-08-03T20:11:28.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper validation of the ChassisID TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows attackers to cause a denial of service due to a negative number passed to the memcpy function via a crafted lldp packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/ - https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities
CVE ID: CVE-2021-25847 State: PUBLISHED Published: 2021-05-10T10:43:02 Last Updated: 2024-08-03T20:11:28.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to controllable loop counter variable via a crafted lldp packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/ - https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities
CVE ID: CVE-2021-25848 State: PUBLISHED Published: 2021-05-10T10:42:55 Last Updated: 2024-08-03T20:11:28.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: Improper validation of the length field of LLDP-MED TLV in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, allows information disclosure to attackers due to using fixed loop counter variable without checking the actual available length via a crafted lldp packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/ - https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities
CVE ID: CVE-2021-25849 State: PUBLISHED Published: 2021-05-10T10:52:33 Last Updated: 2024-08-03T20:11:28.476Z Vendors: n/a Products: n/a Problem Types: n/a Description: An integer underflow was discovered in userdisk/vport_lldpd in Moxa Camera VPort 06EC-2V Series, version 1.1, improper validation of the PortID TLV leads to Denial of Service via a crafted lldp packet. Additional Analyst Notes: - CVE Program Container: References: - https://www.moxa.com/en/ - https://www.moxa.com/en/support/product-support/security-advisory/vport-06ec-2v-series-ip-cameras-vulnerabilities
CVE ID: CVE-2021-25856 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:50:30.250Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in pcmt superMicro-CMS version 3.11, allows attackers to delete files via crafted image file in images.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pcmt/superMicro-CMS/issues/1
CVE ID: CVE-2021-25857 State: PUBLISHED Published: 2023-08-11T00:00:00 Last Updated: 2024-10-09T17:49:58.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in pcmt superMicro-CMS version 3.11, allows authenticated attackers to execute arbitrary code via the font_type parameter to setup.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pcmt/superMicro-CMS/issues/2
CVE ID: CVE-2021-25863 State: PUBLISHED Published: 2021-01-26T07:05:27 Last Updated: 2024-08-03T20:11:28.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open5GS 2.1.3 listens on 0.0.0.0:3000 and has a default password of 1423 for the admin account. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/open5gs/open5gs/issues/764
CVE ID: CVE-2021-25864 State: PUBLISHED Published: 2021-01-26T07:09:07 Last Updated: 2024-08-03T20:11:28.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fetch an arbitrary file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Foddy/node-red-contrib-huemagic/issues/217
CVE ID: CVE-2021-25874 State: PUBLISHED Published: 2021-11-01T11:32:48 Last Updated: 2024-08-03T20:11:28.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior is affected by a SQL Injection SQL injection in the catName parameter which allows a remote unauthenticated attacker to retrieve databases information such as application passwords hashes. Additional Analyst Notes: - CVE Program Container: References: - http://avideoyouphptube.com - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2021-25875 State: PUBLISHED Published: 2021-11-01T11:32:57 Last Updated: 2024-08-03T20:11:28.496Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVideo/YouPHPTube AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the searchPhrase parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator. Additional Analyst Notes: - CVE Program Container: References: - http://avideoyouphptube.com - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2021-25876 State: PUBLISHED Published: 2021-11-01T11:33:10 Last Updated: 2024-08-03T20:11:28.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator. Additional Analyst Notes: - CVE Program Container: References: - http://avideoyouphptube.com - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2021-25877 State: PUBLISHED Published: 2021-11-01T11:33:18 Last Updated: 2024-08-03T20:11:28.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVideo/YouPHPTube 10.0 and prior is affected by Insecure file write. An administrator privileged user is able to write files on filesystem using flag and code variables in file save.php. Additional Analyst Notes: - CVE Program Container: References: - http://avideoyouphptube.com - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2021-25878 State: PUBLISHED Published: 2021-11-01T11:33:25 Last Updated: 2024-08-03T20:11:28.446Z Vendors: n/a Products: n/a Problem Types: n/a Description: AVideo/YouPHPTube 10.0 and prior is affected by multiple reflected Cross Script Scripting vulnerabilities via the videoName parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator. Additional Analyst Notes: - CVE Program Container: References: - http://avideoyouphptube.com - https://synacktiv.com - https://www.synacktiv.com/sites/default/files/2021-01/YouPHPTube_Multiple_Vulnerabilities.pdf
CVE ID: CVE-2021-25893 State: PUBLISHED Published: 2021-04-02T11:31:08 Last Updated: 2024-08-03T20:11:28.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the setText parameter of /magnoliaAuthor/.magnolia/. Additional Analyst Notes: - CVE Program Container: References: - https://www.magnolia-cms.com - https://www.itas.vn/itas-security-team-found-multi-vulnerabilities-on-magnolia-cms-platform/ - https://docs.magnolia-cms.com/product-docs/Releases/Release-notes-for-Magnolia-CMS-6.2.4.html#ReleasenotesforMagnoliaCMS6.2.4-Notablebugfixes
CVE ID: CVE-2021-25894 State: PUBLISHED Published: 2021-04-02T11:31:15 Last Updated: 2024-08-03T20:11:28.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Magnolia CMS from 6.1.3 to 6.2.3 contains a stored cross-site scripting (XSS) vulnerability in the /magnoliaPublic/travel/members/login.html mgnlUserId parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.itas.vn/itas-security-team-found-multi-vulnerabilities-on-magnolia-cms-platform/ - https://www.magnolia-cms.com/ - https://git.magnolia-cms.com/projects/MODULES/repos/public-user-registration/commits/80c096c24d39ba2050b778e68ef838d79d4811dc
CVE ID: CVE-2021-25898 State: PUBLISHED Published: 2021-04-23T20:47:25 Last Updated: 2024-08-03T20:11:28.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. Passwords are stored in unencrypted source-code text files. This was noted when accessing the svc-login.php file. The value is used to authenticate a high-privileged user upon authenticating with the server. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belon
ecurity-advisories/?fid=28765 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
CVE ID: CVE-2021-25899 State: PUBLISHED Published: 2021-04-23T20:49:37 Last Updated: 2024-08-03T20:11:28.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in svc-login.php in Void Aural Rec Monitor 9.0.0.1. An unauthenticated attacker can send a crafted HTTP request to perform a blind time-based SQL Injection. The vulnerable parameter is param1. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=28765 - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/all-your-databases-belong-to-me-a-blind-sqli-case-study/
CVE ID: CVE-2021-25900 State: PUBLISHED Published: 2021-01-22T09:03:36 Last Updated: 2024-08-03T20:11:28.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the smallvec crate before 0.6.14 and 1.x before 1.6.1 for Rust. There is a heap-based buffer overflow in SmallVec::insert_many. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0003.html
CVE ID: CVE-2021-25901 State: PUBLISHED Published: 2021-01-22T09:03:24 Last Updated: 2024-08-03T20:11:28.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the lazy-init crate through 2021-01-17 for Rust. Lazy lacks a Send bound, leading to a data race. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0004.html
CVE ID: CVE-2021-25902 State: PUBLISHED Published: 2021-01-22T09:03:11 Last Updated: 2024-08-03T20:11:28.582Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the glsl-layout crate before 0.4.0 for Rust. When a panic occurs, map_array can perform a double drop. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0005.html
CVE ID: CVE-2021-25903 State: PUBLISHED Published: 2021-01-22T09:02:59 Last Updated: 2024-08-03T20:11:28.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the cache crate through 2021-01-01 for Rust. A raw pointer is dereferenced. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0006.html
CVE ID: CVE-2021-25904 State: PUBLISHED Published: 2021-01-22T09:02:48 Last Updated: 2024-08-03T20:11:28.450Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the av-data crate before 0.3.0 for Rust. A raw pointer is dereferenced, leading to a read of an arbitrary memory address, sometimes causing a segfault. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0007.html
CVE ID: CVE-2021-25905 State: PUBLISHED Published: 2021-01-22T09:02:39 Last Updated: 2024-08-03T20:11:28.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the bra crate before 0.1.1 for Rust. It lacks soundness because it can read uninitialized memory. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0008.html
CVE ID: CVE-2021-25906 State: PUBLISHED Published: 2021-01-22T09:02:30 Last Updated: 2024-08-03T20:11:28.447Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the basic_dsp_matrix crate before 0.9.2 for Rust. When a TransformContent panic occurs, a double drop can be performed. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0009.html
CVE ID: CVE-2021-25907 State: PUBLISHED Published: 2021-01-22T09:02:19 Last Updated: 2024-08-03T20:11:28.473Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the containers crate before 0.9.11 for Rust. When a panic occurs, a util::{mutate,mutate2} double drop can be performed. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0010.html
CVE ID: CVE-2021-25908 State: PUBLISHED Published: 2021-01-22T09:02:02 Last Updated: 2024-08-03T20:11:28.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust. From<EventList> can lead to a double free. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2021-0011.html
CVE ID: CVE-2021-25909 State: PUBLISHED Published: 2021-01-29T13:24:37.269943Z Last Updated: 2024-09-16T18:24:13.155Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: ZIV AUTOMATION Products: 4CCT-EA6-334126BF Problem Types: CWE-400 Description: ZIV Automation 4CCT-EA6-334126BF firmware version 3.23.80.27.36371, allows an unauthenticated, remote attacker to cause a denial of service condition on the device. An attacker could exploit this vulnerability by sending specific packets to the port 7919. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/4cct-vulnerable-denial-service-attack
CVE ID: CVE-2021-25910 State: PUBLISHED Published: 2021-01-29T13:22:29.031521Z Last Updated: 2024-09-16T16:43:41.774Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ZIV AUTOMATION Products: 4CCT-EA6-334126BF Problem Types: CWE-287 Description: Improper Authentication vulnerability in the cookie parameter of ZIV AUTOMATION 4CCT-EA6-334126BF allows a local attacker to perform modifications in several parameters of the affected device as an authenticated user. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/4cct-vulnerable-improper-authentication
CVE ID: CVE-2021-25912 State: PUBLISHED Published: 2021-02-02T18:40:37 Last Updated: 2024-08-03T20:11:28.443Z Vendors: n/a Products: dotty Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25912 - https://github.com/deoxxa/dotty/commit/cd997d37917186c131be71501a698803f2b7ebdb
CVE ID: CVE-2021-25913 State: PUBLISHED Published: 2021-02-08T21:22:45 Last Updated: 2024-08-03T20:11:28.443Z Vendors: n/a Products: set-or-get Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25913 - https://github.com/IonicaBizau/set-or-get.js/commit/82ede5cccb2e8d13e4f62599203a4389f6d8e936
CVE ID: CVE-2021-25914 State: PUBLISHED Published: 2021-03-01T17:20:50.000Z Last Updated: 2025-04-30T17:35:28.249Z Vendors: n/a Products: object-collider Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25914 - https://github.com/FireBlinkLTD/object-collider/commit/321f75a7f8e7b3393e5b7dd6dd9ab26ede5906e5
CVE ID: CVE-2021-25915 State: PUBLISHED Published: 2021-03-09T14:20:22.000Z Last Updated: 2025-04-30T17:35:23.225Z Vendors: n/a Products: changeset Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25915 - https://github.com/eugeneware/changeset/commit/9e588844edbb9993b32e7366cc799262b4447f99
CVE ID: CVE-2021-25916 State: PUBLISHED Published: 2021-03-16T15:07:42.000Z Last Updated: 2025-04-30T17:35:17.268Z Vendors: n/a Products: patchmerge Problem Types: Prototype Pollution Description: Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25916 - https://github.com/pjshumphreys/patchmerge/commit/5b383c537eae7a00ebd26d3f7211dac99ddecb12
CVE ID: CVE-2021-25917 State: PUBLISHED Published: 2021-03-22T19:36:10.000Z Last Updated: 2025-04-30T17:34:51.053Z Vendors: n/a Products: openemr Problem Types: Cross-Site-Scripting Description: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware
: - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25917
CVE ID: CVE-2021-25918 State: PUBLISHED Published: 2021-03-22T19:33:12.000Z Last Updated: 2025-04-30T17:34:56.101Z Vendors: n/a Products: openemr Problem Types: Cross-Site-Scripting Description: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulne
//github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25918
CVE ID: CVE-2021-25919 State: PUBLISHED Published: 2021-03-22T19:22:49.000Z Last Updated: 2025-04-30T17:35:12.194Z Vendors: n/a Products: openemr Problem Types: Cross-Site-Scripting Description: In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25919 - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f
CVE ID: CVE-2021-25920 State: PUBLISHED Published: 2021-03-22T19:29:54.000Z Last Updated: 2025-04-30T17:35:01.031Z Vendors: n/a Products: openemr Problem Types: Improper Access Control Description: In OpenEMR, versions v2.7.2-rc1 to 6.0.0 are vulnerable to Improper Access Control when creating a new user, which leads to a malicious user able to read and send sensitive messages on behalf of the victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25920
CVE ID: CVE-2021-25921 State: PUBLISHED Published: 2021-03-22T19:26:23.000Z Last Updated: 2025-04-30T17:35:06.072Z Vendors: n/a Products: openemr Problem Types: Cross-Site-Scripting Description: In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-
r/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25921
CVE ID: CVE-2021-25922 State: PUBLISHED Published: 2021-03-22T19:39:21 Last Updated: 2024-08-03T20:11:28.488Z Vendors: n/a Products: openemr Problem Types: Cross-Site-Scripting Description: In OpenEMR, versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/commit/0fadc3e592d84bc9dfe9e0403f8bd6e3c7d8427f - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25922