Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-39371 State: PUBLISHED Published: 2021-08-23T00:03:20 Last Updated: 2024-08-04T02:06:42.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/geopython/pywps/pull/616 - https://github.com/geopython/OWSLib/issues/790 - https://lists.debian.org/debian-lts-announce/2021/09/msg00001.html
CVE ID: CVE-2021-39373 State: PUBLISHED Published: 2021-09-01T12:29:59 Last Updated: 2024-08-04T02:06:42.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Samsung Drive Manager 2.0.104 on Samsung H3 devices allows attackers to bypass intended access controls on disk management. WideCharToMultiByte, WideCharStr, and MultiByteStr can contribute to password exposure. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bosslabdcu/Vulnerability-Reporting/security/advisories/GHSA-j3f7-346q-97f4
CVE ID: CVE-2021-39375 State: PUBLISHED Published: 2021-08-24T12:39:31 Last Updated: 2024-08-04T02:06:42.509Z Vendors: n/a Products: n/a Problem Types: n/a Description: Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the WAdvancedFilter/getDimensionItemsByCode FilterValue parameter. Additional Analyst Notes: - CVE Program Container: References: - https://diesec.home.blog/2021/08/24/philips-tasy-emr-3-06-sql-injection-cve-2021-39375cve-2021-39376/
CVE ID: CVE-2021-39376 State: PUBLISHED Published: 2021-08-24T12:38:05 Last Updated: 2024-08-04T02:06:42.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: Philips Healthcare Tasy Electronic Medical Record (EMR) 3.06 allows SQL injection via the CorCad_F2/executaConsultaEspecifico IE_CORPO_ASSIST or CD_USUARIO_CONVENIO parameter. Additional Analyst Notes: - CVE Program Container: References: - https://diesec.home.blog/2021/08/24/philips-tasy-emr-3-06-sql-injection-cve-2021-39375cve-2021-39376/
CVE ID: CVE-2021-39377 State: PUBLISHED Published: 2021-09-01T12:33:54 Last Updated: 2024-08-04T02:06:42.506Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the index.php username parameter. Additional Analyst Notes: - CVE Program Container: References: - https://opensis.com/ - https://github.com/OS4ED/openSIS-Classic - https://github.com/security-n/CVE-2021-39377
CVE ID: CVE-2021-39378 State: PUBLISHED Published: 2021-09-01T12:28:53 Last Updated: 2024-08-04T02:06:42.402Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the NamesList.php str parameter. Additional Analyst Notes: - CVE Program Container: References: - https://opensis.com/ - https://github.com/OS4ED/openSIS-Classic - https://github.com/security-n/CVE-2021-39378
CVE ID: CVE-2021-39379 State: PUBLISHED Published: 2021-09-01T12:41:24 Last Updated: 2024-08-04T02:06:42.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. A malicious attacker can issue SQL commands to the MySQL (MariaDB) database through the ResetUserInfo.php password_stn_id parameter. Additional Analyst Notes: - CVE Program Container: References: - https://opensis.com/ - https://github.com/OS4ED/openSIS-Classic - https://github.com/security-n/CVE-2021-39379
CVE ID: CVE-2021-39383 State: PUBLISHED Published: 2022-03-20T21:12:02 Last Updated: 2024-08-04T02:06:42.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wkeyuan/DWSurvey/issues/81
CVE ID: CVE-2021-39384 State: PUBLISHED Published: 2022-03-20T21:12:07 Last Updated: 2024-08-04T02:06:42.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wkeyuan/DWSurvey/issues/80
CVE ID: CVE-2021-39390 State: PUBLISHED Published: 2022-05-03T12:05:36 Last Updated: 2024-08-04T02:06:42.505Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://demo.partkeepr.org/ - https://partkeepr.org/ - https://github.com/partkeepr/PartKeepr/issues/1237
CVE ID: CVE-2021-39391 State: PUBLISHED Published: 2021-09-14T17:27:23 Last Updated: 2024-08-04T02:06:42.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/beego/beego - https://github.com/beego/beego/issues/4727
CVE ID: CVE-2021-39392 State: PUBLISHED Published: 2021-09-15T16:16:09 Last Updated: 2024-08-04T02:06:42.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code. Additional Analyst Notes: - CVE Program Container: References: - http://www.mylittlebackup.com/mlb/zip/mlb_1.7.zip - https://gist.github.com/omriinbar/65827626e63f15e3e50557e2d9d61281
CVE ID: CVE-2021-39393 State: PUBLISHED Published: 2022-08-26T12:50:30 Last Updated: 2024-08-04T02:06:42.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: mm-wiki v0.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the markdown editor. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phachon/mm-wiki/issues/315
CVE ID: CVE-2021-39394 State: PUBLISHED Published: 2022-08-26T12:50:45 Last Updated: 2024-08-04T02:06:42.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: mm-wiki v0.2.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add user accounts and modify user information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phachon/mm-wiki/issues/316
CVE ID: CVE-2021-39402 State: PUBLISHED Published: 2021-09-20T14:23:21 Last Updated: 2024-08-04T02:06:42.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors. Additional Analyst Notes: - CVE Program Container: References: - https://www.maianscriptworld.co.uk/ - https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
CVE ID: CVE-2021-39404 State: PUBLISHED Published: 2021-09-22T13:01:12 Last Updated: 2024-08-04T02:06:42.552Z Vendors: n/a Products: n/a Problem Types: n/a Description: MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mari0x00/MaianAffiliate-Code-execution-and-XSS
CVE ID: CVE-2021-39408 State: PUBLISHED Published: 2022-06-24T16:20:11 Last Updated: 2024-08-04T02:06:42.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Online Student Rate System 1.0 via the page parameter on the index.php file Additional Analyst Notes: - CVE Program Container: References: - https://github.com/StefanDorresteijn/CVE-2021-39408
CVE ID: CVE-2021-39409 State: PUBLISHED Published: 2022-06-24T16:22:33 Last Updated: 2024-08-04T02:06:42.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authenticated. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/StefanDorresteijn/CVE-2021-39409
CVE ID: CVE-2021-39411 State: PUBLISHED Published: 2021-11-05T14:32:39 Last Updated: 2024-08-04T02:06:42.412Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php, and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/hmsp/
CVE ID: CVE-2021-39412 State: PUBLISHED Published: 2021-11-05T14:43:30 Last Updated: 2024-08-04T02:06:42.604Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php, (b) server_side/scripts/jsonp.php, and (c) scripts/objects_jsonp.php, the (2) value parameter in examples_support/editable_ajax.php, and the (3) PHP_SELF parameter in captcha/index.php. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/php-gurukul-shopping/
CVE ID: CVE-2021-39413 State: PUBLISHED Published: 2021-11-05T15:12:25 Last Updated: 2024-08-04T02:06:42.425Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exits in SEO Panel v4.8.0 via the (1) to_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, and (j) reports.php; the (2) from_time parameter in (a) backlinks.php, (b) analytics.php, (c) log.php, (d) overview.php, (e) pagespeed.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) r
d.php, (f) rank.php, (g) review.php, (h) saturationchecker.php, (i) social_media.php, (j) webmaster-tools.php, and (k) reports.php; the (3) order_col parameter in (a) analytics.php, (b) review.php, (c) social_media.php, and (d) webmaster-tools.php; and the (4) pageno parameter in (a) alerts.php, (b) log.php, (c) keywords.php, (d) proxy.php, (e) searchengine.php, and (f) siteauditor.php. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/seo-panel/
CVE ID: CVE-2021-39416 State: PUBLISHED Published: 2021-11-05T16:00:04 Last Updated: 2024-08-04T02:06:42.507Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact, (b) Email, (c) Weight, (d) Profession, (e) ref_contact, (f) address, (g) gender, (h) age, and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact, (b) Email, (c) Weight, Profession, (d) ref_contact, (e) address, (f) serial, (g) age, and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Addres
parameters; in (3) staff/edit-my-profile.php via the (a) Title, (b) First Name, (c) Last Name, (d) Skype, and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name, (b) guardian_short_name, (c) guardian_name, (d) opening_time, (e) closing_time, (f) access_level_5, (g) access_level_4, (h) access_level_ 3, (i) access_level_2, (j) access_level_1, (k) currency, (l) mobile_number, (m) address, (n) patient_contact, (o) patient_address, and (p) patient_email parameters. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/remote-clinic/ - https://github.com/remoteclinic/RemoteClinic/issues/17 - https://remoteclinic.io
CVE ID: CVE-2021-39420 State: PUBLISHED Published: 2021-11-08T18:07:03 Last Updated: 2024-08-04T02:06:42.539Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Cross Site Scripting (XSS) vulnerabilities exist in VFront 0.99.5 via the (1) s parameter in search_all.php and the (2) msg parameter in add.attach.php. Additional Analyst Notes: - CVE Program Container: References: - https://sisl.lab.uic.edu/projects/chess/vfront0-99-5/
CVE ID: CVE-2021-39421 State: PUBLISHED Published: 2023-07-24T00:00:00 Last Updated: 2024-10-24T15:51:26.992Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://medium.com/%40rohitgautam26/cve-2021-39421-76fa68817cd
CVE ID: CVE-2021-39425 State: PUBLISHED Published: 2023-07-20T00:00:00 Last Updated: 2024-10-24T16:51:31.219Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/11-Client_Side_Testing/04-Testing_for_Client_Side_URL_Redirect - https://medium.com/%40rohitgautam26/cve-2021-39425-8a336eba34dd
CVE ID: CVE-2021-39426 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T18:44:48.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in /Upload/admin/admin_notify.php in Seacms 11.4 allows attackers to execute arbitrary php code via the notify1 parameter when the action parameter equals set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/seacms-com/seacms/issues/21
CVE ID: CVE-2021-39427 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T18:43:56.546Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/vtime-tech/188Jianzhan/issues/4
CVE ID: CVE-2021-39428 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T18:42:06.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filename for edit_users_head_pic. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/eyoucms/eyoucms/issues/14
CVE ID: CVE-2021-39432 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T19:07:53.930Z Vendors: n/a Products: n/a Problem Types: n/a Description: diplib v3.0.0 is vulnerable to Double Free. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/DIPlib/diplib/issues/80 - https://github.com/DIPlib/diplib/commit/8b9a2670ce66ff2fd5addf592f7825e1f5adb5b5
CVE ID: CVE-2021-39433 State: PUBLISHED Published: 2021-10-04T19:16:26 Last Updated: 2024-08-04T02:06:42.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user. Additional Analyst Notes: - CVE Program Container: References: - https://biqs-drive.be/ - https://github.com/PinkDraconian/CVE-2021-39433/blob/main/README.md
CVE ID: CVE-2021-39434 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-24T13:28:02.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cnvd.org.cn/flaw/show/CNVD-2018-26041
CVE ID: CVE-2021-39458 State: PUBLISHED Published: 2021-09-09T11:32:36 Last Updated: 2024-08-04T02:06:42.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/evildrummer/CVE-2021-XYZ2 - https://github.com/evildrummer/MyOwnCVEs/tree/main/CVE-2021-39458
CVE ID: CVE-2021-39459 State: PUBLISHED Published: 2021-09-09T11:32:44 Last Updated: 2024-08-04T02:06:42.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/evildrummer/CVE-2021-XYZ - https://github.com/evildrummer/MyOwnCVEs/tree/main/CVE-2021-39459
CVE ID: CVE-2021-39473 State: PUBLISHED Published: 2022-11-04T00:00:00.000Z Last Updated: 2025-05-02T19:05:46.077Z Vendors: n/a Products: n/a Problem Types: n/a Description: Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Saibamen/HotelManager - https://github.com/Saibamen/HotelManager/issues/49 - https://github.com/BrunoTeixeira1996/CVE-2021-39473
CVE ID: CVE-2021-39474 State: PUBLISHED Published: 2021-11-10T11:30:14 Last Updated: 2024-08-04T02:06:42.679Z Vendors: n/a Products: n/a Problem Types: n/a Description: Vulnerability in the product Docsis 3.0 UBC1319BA00 Router supported affected version 1319010201r009. The vulnerability allows an attacker with privileges and network access through the ping.cmd component to execute commands on the device. Additional Analyst Notes: - CVE Program Container: References: - https://saikotwolf.medium.com/f9ed24e14e51 - https://www.ubeeinteractive.com/?product=ubc1319
CVE ID: CVE-2021-39480 State: PUBLISHED Published: 2022-01-21T21:32:21 Last Updated: 2024-08-04T02:06:42.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bingrep v0.8.5 was discovered to contain a memory allocation failure which can cause a Denial of Service (DoS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/m4b/bingrep/issues/30
CVE ID: CVE-2021-39486 State: PUBLISHED Published: 2021-10-04T13:45:26 Last Updated: 2024-08-04T02:06:42.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies, passwords or to run arbitrary code on a victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.navidkagalwalla.com/gila-cms-vulnerabilities
CVE ID: CVE-2021-39491 State: PUBLISHED Published: 2022-03-24T14:24:26 Last Updated: 2024-08-04T02:06:42.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box . . Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yogeshojha/rengine/issues/460
CVE ID: CVE-2021-39496 State: PUBLISHED Published: 2021-09-07T19:54:38 Last Updated: 2024-08-04T02:06:42.435Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/releases/tag/v1.5.4 - https://github.com/KietNA-HPT/CVE
CVE ID: CVE-2021-39497 State: PUBLISHED Published: 2021-09-07T19:57:08 Last Updated: 2024-08-04T02:06:42.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: eyoucms 1.5.4 lacks sanitization of input data, allowing an attacker to inject a url to trigger blind SSRF via the saveRemote() function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/releases/tag/v1.5.4 - http://hptcybersec.com/ssrf_PoC.jpg - https://github.com/KietNA-HPT/CVE
CVE ID: CVE-2021-39499 State: PUBLISHED Published: 2021-09-07T19:59:42 Last Updated: 2024-08-04T02:06:42.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/18 - https://github.com/KietNA-HPT/CVE
CVE ID: CVE-2021-39500 State: PUBLISHED Published: 2021-09-07T20:01:25 Last Updated: 2024-08-04T02:06:42.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: Eyoucms 1.5.4 is vulnerable to Directory Traversal. Due to a lack of input data sanitizaton in param tpldir, filename, type, nid an attacker can inject "../" to escape and write file to writeable directories. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/releases/tag/v1.5.4 - https://github.com/KietNA-HPT/CVE
CVE ID: CVE-2021-39501 State: PUBLISHED Published: 2021-09-07T20:03:05 Last Updated: 2024-08-04T02:06:42.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eyoucms/eyoucms/issues/17 - https://github.com/KietNA-HPT/CVE
CVE ID: CVE-2021-39503 State: PUBLISHED Published: 2021-09-07T19:51:23 Last Updated: 2024-08-04T02:06:42.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPMyWind 5.6 is vulnerable to Remote Code Execution. Becase input is filtered without "<, >, ?, =, `,...." In WriteConfig() function, an attacker can inject php code to /include/config.cache.php file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gaozhifeng/PHPMyWind/issues/15 - https://github.com/KietNA-HPT/CVE