Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-41635 State: PUBLISHED Published: 2022-06-24T11:46:04 Last Updated: 2024-08-04T03:15:29.268Z Vendors: n/a Products: n/a Problem Types: n/a Description: When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations or vulnerabilities with administrative access over the entire host system. Additional Analyst Notes: - CVE Program Container: References: - https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
CVE ID: CVE-2021-41636 State: PUBLISHED Published: 2022-06-24T11:45:10 Last Updated: 2024-08-04T03:15:29.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: MELAG FTP Server 2.2.0.4 allows an attacker to use the CWD command to break out of the FTP servers root directory and operate on the entire operating system, while the access restrictions of the user running the FTP server apply. Additional Analyst Notes: - CVE Program Container: References: - https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
CVE ID: CVE-2021-41637 State: PUBLISHED Published: 2022-06-24T11:44:42 Last Updated: 2024-08-04T03:15:29.216Z Vendors: n/a Products: n/a Problem Types: n/a Description: Weak access control permissions in MELAG FTP Server 2.2.0.4 allow the "Everyone" group to read the local FTP configuration file, which includes among other information the unencrypted passwords of all FTP users. Additional Analyst Notes: - CVE Program Container: References: - https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
CVE ID: CVE-2021-41638 State: PUBLISHED Published: 2022-06-24T11:44:02 Last Updated: 2024-08-04T03:15:29.322Z Vendors: n/a Products: n/a Problem Types: n/a Description: The authentication checks of the MELAG FTP Server in version 2.2.0.4 are incomplete, which allows a remote attacker to access local files only by using a valid username. Additional Analyst Notes: - CVE Program Container: References: - https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
CVE ID: CVE-2021-41639 State: PUBLISHED Published: 2022-06-24T11:43:34 Last Updated: 2024-08-04T03:15:29.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://www.securesystems.de/blog/advisory-and-exploitation-the-melag-ftp-server/
CVE ID: CVE-2021-41641 State: PUBLISHED Published: 2022-06-12T12:12:08 Last Updated: 2024-08-04T03:15:29.241Z Vendors: n/a Products: n/a Problem Types: n/a Description: Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory. Additional Analyst Notes: - CVE Program Container: References: - https://hackers.report/report/614876917a7b150012836bb8 - https://github.com/denoland/deno/issues/12152
CVE ID: CVE-2021-41643 State: PUBLISHED Published: 2021-10-29T16:50:45 Last Updated: 2024-08-04T03:15:29.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution (RCE) vulnerability exists in Sourcecodester Church Management System 1.0 via the image upload field. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50306
CVE ID: CVE-2021-41644 State: PUBLISHED Published: 2021-10-29T16:55:52 Last Updated: 2024-08-04T03:15:29.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Exection (RCE) vulnerability exists in Sourcecodester Online Food Ordering System 2.0 via a maliciously crafted PHP file that bypasses the image upload filters. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50305
CVE ID: CVE-2021-41645 State: PUBLISHED Published: 2021-10-29T16:59:32 Last Updated: 2024-08-04T03:15:29.289Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution (RCE) vulnerability exists in Sourcecodester Budget and Expense Tracker System 1.0 that allows a remote malicious user to inject arbitrary code via the image upload field. . Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50308
CVE ID: CVE-2021-41646 State: PUBLISHED Published: 2021-10-29T17:02:57 Last Updated: 2024-08-04T03:15:29.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters.. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50319 - https://www.nu11secur1ty.com/2021/12/cve-2021-41646.html
CVE ID: CVE-2021-41647 State: PUBLISHED Published: 2021-10-01T14:32:43 Last Updated: 2024-08-04T03:15:29.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kaushikjadhav01/Online-Food-Ordering-Web-App - https://github.com/MobiusBinary/CVE-2021-41647 - http://packetstormsecurity.com/files/164422/Online-Foo
dering-Web-App - https://github.com/MobiusBinary/CVE-2021-41647 - http://packetstormsecurity.com/files/164422/Online-Food-Ordering-Web-App-SQL-Injection.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41647
CVE ID: CVE-2021-41648 State: PUBLISHED Published: 2021-10-01T13:53:37 Last Updated: 2024-08-04T03:15:29.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input. Additional Analyst Notes: - CVE Program Container: References: - https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system - https://github.com/MobiusBinary/CVE-2021-41648 - http://packetstormsecurity.com/files/165036/PuneethReddyHC-Online-Shopping-System-Advanced-1.0-SQL-Injection.html - https://github.com/nu11secur1ty/CVE-m
les/165036/PuneethReddyHC-Online-Shopping-System-Advanced-1.0-SQL-Injection.html - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41648 - https://www.nu11secur1ty.com/2021/11/cve-2021-41648.html
CVE ID: CVE-2021-41649 State: PUBLISHED Published: 2021-10-01T13:51:05 Last Updated: 2024-08-04T03:15:29.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input. Additional Analyst Notes: - CVE Program Container: References: - https://awesomeopensource.com/project/PuneethReddyHC/online-shopping-system - https://streamable.com/aii806 - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41649 - https://streamable.com/mnn7dn
CVE ID: CVE-2021-41651 State: PUBLISHED Published: 2021-10-04T18:01:24 Last Updated: 2024-08-04T03:15:29.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in process_update_profile.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tramyardg/hotel-mgmt-system - https://github.com/MobiusBinary/CVE-2021-41651/
CVE ID: CVE-2021-41652 State: PUBLISHED Published: 2022-03-01T22:38:47 Last Updated: 2024-08-04T03:15:29.282Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database. Additional Analyst Notes: - CVE Program Container: References: - https://deathflash1411.github.io/blog/dumping-batflat-cms-database - https://github.com/sruupl/batflat/issues/113
CVE ID: CVE-2021-41653 State: PUBLISHED Published: 2021-11-13T14:18:52 Last Updated: 2024-08-04T03:15:29.120Z Vendors: n/a Products: n/a Problem Types: n/a Description: The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field. Additional Analyst Notes: - CVE Program Container: References: - http://tp-link.com - https://www.tp-link.com/us/press/security-advisory/ - https://k4m1ll0.com/cve-2021-41653.html
CVE ID: CVE-2021-41654 State: PUBLISHED Published: 2022-06-16T11:22:05 Last Updated: 2024-08-04T03:15:29.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wuzhicms/wuzhicms/issues/198
CVE ID: CVE-2021-41657 State: PUBLISHED Published: 2022-03-07T21:02:53 Last Updated: 2024-08-04T03:15:29.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack. Additional Analyst Notes: - CVE Program Container: References: - http://codecollaborator.com - http://smartbear.com - https://gist.github.com/rvismit/2b1a10a48104e01f575cc948da69df19
CVE ID: CVE-2021-41658 State: PUBLISHED Published: 2022-01-24T16:03:34 Last Updated: 2024-08-04T03:15:29.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Sourcecodester Student Quarterly Grading System by oretnom23, allows attackers to execute arbitrary code via the fullname and username parameters to the users page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-15-092121
CVE ID: CVE-2021-41659 State: PUBLISHED Published: 2022-01-24T17:47:42 Last Updated: 2024-08-04T03:15:29.401Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-16-092421
CVE ID: CVE-2021-41660 State: PUBLISHED Published: 2022-01-24T17:52:28 Last Updated: 2024-08-04T03:15:29.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password fields to login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/CVE-nu11-06-092421
CVE ID: CVE-2021-41661 State: PUBLISHED Published: 2022-06-13T22:30:41 Last Updated: 2024-08-04T03:15:29.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janikwehrli1/0dayHunt/blob/main/Church_Managementv1.0_RCE.py
CVE ID: CVE-2021-41662 State: PUBLISHED Published: 2022-06-13T22:45:26 Last Updated: 2024-08-04T03:15:29.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file upload, which is caused by improper file handling in the editImg function. This vulnerability leads to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janikwehrli1/0dayHunt/blob/main/SouthGateInn_RCE.py
CVE ID: CVE-2021-41663 State: PUBLISHED Published: 2022-06-13T17:10:56 Last Updated: 2024-08-04T03:15:29.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS - http://minicms.com - https://github.com/bg5sbk/MiniCMS/issues/41
CVE ID: CVE-2021-41672 State: PUBLISHED Published: 2022-06-15T15:13:44 Last Updated: 2024-08-04T03:15:29.266Z Vendors: n/a Products: n/a Problem Types: n/a Description: PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. A user that belongs to the administrator group can inject a malicious SQL query in order to affect the execution logic of the application and retrive information from the database. Additional Analyst Notes: - CVE Program Container: References: - http://peel.com - https://github.com/advisto/peel-shopping/issues/5
CVE ID: CVE-2021-41674 State: PUBLISHED Published: 2021-10-29T15:30:46 Last Updated: 2024-08-04T03:15:29.221Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/login.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janikwehrli1/0dayHunt/blob/main/E-Negosyo-System-SQLi.txt - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41674 - https://streamable.com/sm0uxf
CVE ID: CVE-2021-41675 State: PUBLISHED Published: 2021-10-29T15:38:24 Last Updated: 2024-08-04T03:15:29.222Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which validates images with getImageSizei. . Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janikwehrli1/0dayHunt/blob/main/E-Negosyo-Authenticated-RCE.py - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41675 - https://www.nu11secur1ty.com/2021/11/cve-2021-41675.html
CVE ID: CVE-2021-41676 State: PUBLISHED Published: 2021-10-29T15:54:18 Last Updated: 2024-08-04T03:15:29.203Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janikwehrli1/0dayHunt/blob/main/pharmacypossqli.txt - https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41676
CVE ID: CVE-2021-41677 State: PUBLISHED Published: 2021-11-30T12:59:16 Last Updated: 2024-08-04T03:15:29.397Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/202
CVE ID: CVE-2021-41678 State: PUBLISHED Published: 2021-11-30T13:07:34 Last Updated: 2024-08-04T03:15:29.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/203
CVE ID: CVE-2021-41679 State: PUBLISHED Published: 2021-11-30T13:17:14 Last Updated: 2024-08-04T03:15:29.197Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/OS4ED/openSIS-Classic/issues/204
CVE ID: CVE-2021-41682 State: PUBLISHED Published: 2022-06-20T13:14:05 Last Updated: 2024-08-04T03:15:29.264Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma_compare_ecma_non_direct_strings in JerryScript 2.4.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4747
CVE ID: CVE-2021-41683 State: PUBLISHED Published: 2022-06-20T13:33:04 Last Updated: 2024-08-04T03:15:29.275Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is a stack-overflow at ecma-helpers.c:326 in ecma_get_lex_env_type in JerryScript 2.4.0 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jerryscript-project/jerryscript/issues/4745
CVE ID: CVE-2021-41687 State: PUBLISHED Published: 2022-06-28T09:46:23.000Z Last Updated: 2025-11-03T20:33:55.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/DCMTK/dcmtk - https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2021-41688 State: PUBLISHED Published: 2022-06-28T09:44:06.000Z Last Updated: 2025-11-03T20:33:56.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DCMTK/dcmtk - https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb - https://lists.debian.org/debian-lts-announce/2024/06/msg00
DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2021-41689 State: PUBLISHED Published: 2022-06-28T09:38:17.000Z Last Updated: 2025-11-03T20:33:58.161Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DCMTK/dcmtk - https://github.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d - https://lists.debian.org/debian-lts-announce/2024/06
b.com/DCMTK/dcmtk/commit/5c14bf53fb42ceca12bbcc0016e8704b1580920d - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2021-41690 State: PUBLISHED Published: 2022-06-28T09:41:00.000Z Last Updated: 2025-11-03T20:33:59.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DCMTK/dcmtk - https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb - https://lists.debian.org
/DCMTK/dcmtk - https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2021-41691 State: PUBLISHED Published: 2025-06-24T00:00:00.000Z Last Updated: 2025-06-25T14:34:52.796Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://opensis.com/ - https://github.com/OS4ED/openSIS-Classic/ - https://resources.s4e.io/blog/opensis-student-information-system-0-day-vulnerability-cve-2021-41691/
CVE ID: CVE-2021-41694 State: PUBLISHED Published: 2021-12-09T15:22:51 Last Updated: 2024-08-04T03:15:29.239Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.chudamax.com/posts/multiple-vulnerabilities-in-belloo-dating-script/
CVE ID: CVE-2021-41695 State: PUBLISHED Published: 2021-12-09T15:29:14 Last Updated: 2024-08-04T03:15:29.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. . Additional Analyst Notes: - CVE Program Container: References: - https://www.chudamax.com/posts/multiple-vulnerabilities-in-belloo-dating-script/
CVE ID: CVE-2021-41696 State: PUBLISHED Published: 2021-12-09T15:33:49 Last Updated: 2024-08-04T03:15:29.111Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.chudamax.com/posts/multiple-vulnerabilities-in-belloo-dating-script/
CVE ID: CVE-2021-41697 State: PUBLISHED Published: 2021-12-09T15:35:25 Last Updated: 2024-08-04T03:15:29.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/sources/instagram.php script. Additional Analyst Notes: - CVE Program Container: References: - https://www.chudamax.com/posts/multiple-vulnerabilities-in-belloo-dating-script/
CVE ID: CVE-2021-41714 State: PUBLISHED Published: 2022-05-23T15:34:34 Last Updated: 2024-08-04T03:15:29.271Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage. Additional Analyst Notes: - CVE Program Container: References: - https://www.yuque.com/henry-weply/penetration/fza5hm - https://github.com/sdfsky/tipask/blob/c4e6aa9f6017c9664780570016954c0922d203b7/app/Http/Controllers/A
netration/fza5hm - https://github.com/sdfsky/tipask/blob/c4e6aa9f6017c9664780570016954c0922d203b7/app/Http/Controllers/AttachController.php#L42 - https://github.com/sdfsky/tipask/commit/9b5f13d1708e9a5dc0959cb8a97be1c32b94ca69