Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-36460 State: PUBLISHED Published: 2022-04-25T12:03:38 Last Updated: 2024-08-04T00:54:51.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account's password locally on the device and uses the hash to authenticate in all communication with the backend API, including login, registration and changing of passwords. This allows an attacker in possession of a hash to takeover a user's account, rendering the benefits of storing hashed passwords in the database useless. Additional Analyst Notes: - CVE Program Container: References: - http://veryfitpro.com - http://www.i-doo.cn - https://github.com/martinfrancois/CVE-2
E Program Container: References: - http://veryfitpro.com - http://www.i-doo.cn - https://github.com/martinfrancois/CVE-2021-36460
CVE ID: CVE-2021-36461 State: PUBLISHED Published: 2022-07-15T11:34:48 Last Updated: 2024-08-04T00:54:51.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Arbitrary File Upload vulnerability exists in Microweber 1.1.3 that allows attackers to getshell via the Settings Upload Picture section by uploading pictures with malicious code, user.ini. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/microweber/microweber/issues/751
CVE ID: CVE-2021-36471 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-04-23T21:28:45.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /admin/index2.html, /admin/index3.html URIs. Note: AdminLTE developers dispute that this a weakness with AdminLTE and is instead a misconfiguration error on various websites by the website developers. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/cybersaki/31ffe679a5552c1047164e3a5b01c2fd - https://github.com/Colorlib
richment: References: - https://gist.github.com/cybersaki/31ffe679a5552c1047164e3a5b01c2fd - https://github.com/ColorlibHQ/AdminLTE/issues/4948
CVE ID: CVE-2021-36483 State: PUBLISHED Published: 2021-08-04T10:04:29 Last Updated: 2024-08-04T00:54:51.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: DevExpress.XtraReports.UI through v21.1 allows attackers to execute arbitrary code via insecure deserialization. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/tree-chtsec/27013ed6cb297b24e44f6359439b678e - https://supportcenter.devexpress.com/ticket/details/t708194/net-web-controls-unsafe-data-type-deserialization - https://supportcenter.devexpress.com/ticket/details/t714296/net-desktop-controls-unsafe-data-type-deserialization - https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b3
s/t714296/net-desktop-controls-unsafe-data-type-deserialization - https://www.chtsecurity.com/news/a01d1bc6-19c8-4187-b343-6bc685efe64f - https://supportcenter.devexpress.com/ticket/details/t1031535/reporting-unsafe-data-type-deserialization - https://www.zerodayinitiative.com/advisories/ZDI-22-341/
CVE ID: CVE-2021-36484 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:22:18.164Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.notion.so/JIZHICMS-v1-9-5-SQL-Injection-3a71102958584a20bf22c052c7778bbd
CVE ID: CVE-2021-36489 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-27T13:43:04.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegro_image addon. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liballeg/allegro5/issues/1251
CVE ID: CVE-2021-36493 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-27T13:41:53.974Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://forum.xpdfreader.com/viewtopic.php?f=3&t=42160
CVE ID: CVE-2021-36503 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-27T13:36:12.199Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Fanli2012/native-php-cms/issues/3
CVE ID: CVE-2021-36512 State: PUBLISHED Published: 2021-10-19T11:33:42 Last Updated: 2024-08-04T00:54:51.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in function scanallsubs in src/sbbs3/scansubs.cpp in Synchronet BBS, which may allow attackers to view sensitive information due to an uninitialized value. Additional Analyst Notes: - CVE Program Container: References: - http://synchronet.com - https://gitlab.synchro.net/main/sbbs/-/issues/276
CVE ID: CVE-2021-36513 State: PUBLISHED Published: 2021-10-18T16:07:09 Last Updated: 2024-08-04T00:54:51.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in function sofia_handle_sip_i_notify in sofia.c in SignalWire freeswitch before 1.10.6, may allow attackers to view sensitive information due to an uninitialized value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/signalwire/freeswitch/issues/1245 - https://newreleases.io/project/github/signalwire/freeswitch/release/v1.10.6 - https://github.com/signalwire/freeswitch/releases/tag/v1.10.6
CVE ID: CVE-2021-36520 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T16:57:27.727Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://sourceforge.net/p/trainsmart/code/HEAD/tree/code/ - https://www.go2itech.org/resources/trainsmart/ - http://packetstormsecurity.com/files/171731/itech-TrainSmart-r1044-SQL-Injection.html
CVE ID: CVE-2021-36530 State: PUBLISHED Published: 2021-08-27T15:25:19 Last Updated: 2024-08-04T00:54:51.526Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffer without checking the boundary. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/19
CVE ID: CVE-2021-36531 State: PUBLISHED Published: 2021-08-27T15:24:14 Last Updated: 2024-08-04T00:54:51.591Z Vendors: n/a Products: n/a Problem Types: n/a Description: ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer without checking the boundary. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/miniupnp/ngiflib/issues/18
CVE ID: CVE-2021-36532 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T18:28:53.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/excellentoldtv/portfolioCMS-issues/issues/1
CVE ID: CVE-2021-36535 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:21:34.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cesanta/mjs/issues/175
CVE ID: CVE-2021-36538 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:20:39.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/miglen/b09498b4b9fe1be58973bd474af125ab
CVE ID: CVE-2021-36539 State: PUBLISHED Published: 2023-01-26T00:00:00 Last Updated: 2024-08-04T00:54:51.500Z Vendors: n/a Products: n/a Problem Types: n/a Description: Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/instructure/canvas-lms/issues/1905 - https://github.com/gaukas/instructure-canvas-file-oracle
CVE ID: CVE-2021-36542 State: PUBLISHED Published: 2021-08-03T18:09:48 Last Updated: 2024-08-04T00:54:51.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. Additional Analyst Notes: - CVE Program Container: References: - https://medium.com/%40cyberdivision/cve-2021-36542-a07585497eb8
CVE ID: CVE-2021-36543 State: PUBLISHED Published: 2021-08-03T18:13:37 Last Updated: 2024-08-04T00:54:51.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. Additional Analyst Notes: - CVE Program Container: References: - https://cyberdivision.medium.com/cve-2021-36543-9622f50c6dc
CVE ID: CVE-2021-36544 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:19:37.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/happy_source/tpcms/issues/I3YNWY
CVE ID: CVE-2021-36545 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:18:45.208Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/happy_source/tpcms/issues/I3YUCJ
CVE ID: CVE-2021-36546 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:17:35.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Kitesky/KiteCMS/issues/10
CVE ID: CVE-2021-36547 State: PUBLISHED Published: 2021-10-28T19:11:10 Last Updated: 2024-08-04T00:54:51.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/RCE/issues/1
CVE ID: CVE-2021-36548 State: PUBLISHED Published: 2021-10-28T19:11:10 Last Updated: 2024-08-04T00:54:51.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/monstra-cms/monstra/issues/470
CVE ID: CVE-2021-36550 State: PUBLISHED Published: 2021-10-28T19:11:11 Last Updated: 2024-08-04T00:54:51.531Z Vendors: n/a Products: n/a Problem Types: n/a Description: TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/xss_payload/issues/6
CVE ID: CVE-2021-36551 State: PUBLISHED Published: 2021-10-28T19:11:12 Last Updated: 2024-08-04T00:54:51.589Z Vendors: n/a Products: n/a Problem Types: n/a Description: TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/r0ck3t1973/xss_payload/issues/7
CVE ID: CVE-2021-36560 State: PUBLISHED Published: 2021-11-02T09:59:44 Last Updated: 2024-08-04T00:54:51.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin. Additional Analyst Notes: - CVE Program Container: References: - https://www.sourcecodester.com/ - https://pratikkhalane91.medium.com/cve-2021-35559-bb62022dd08a
CVE ID: CVE-2021-36563 State: PUBLISHED Published: 2021-07-26T17:19:40 Last Updated: 2024-08-04T01:01:57.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts), the XSS payload will be triggered when the user accesses some specific sections of the application. In the same sense a very dangerous potential way would be when an attacker who has the monitor role (not administrator) manages to get a store
ry dangerous potential way would be when an attacker who has the monitor role (not administrator) manages to get a stored XSS to steal the secretAutomation (for the use of the API in administrator mode) and thus be able to create another administrator user who has high privileges on the CheckMK monitoring web console. Another way is that persistent XSS allows an attacker to modify the displayed content or change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session. Additional Analyst Notes: - CVE Program Container: References: - https://checkmk.com/de/werk/12762 - https://checkmk.com/de/wer
nal Analyst Notes: - CVE Program Container: References: - https://checkmk.com/de/werk/12762 - https://checkmk.com/de/werk/13148 - https://github.com/Edgarloyola/CVE-2021-36563
CVE ID: CVE-2021-36564 State: PUBLISHED Published: 2021-12-06T20:22:56 Last Updated: 2024-08-04T01:01:57.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/top-think/framework/issues/2559
CVE ID: CVE-2021-36567 State: PUBLISHED Published: 2021-12-06T20:22:56 Last Updated: 2024-08-04T01:01:57.460Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/top-think/framework/issues/2561
CVE ID: CVE-2021-36568 State: PUBLISHED Published: 2022-09-13T21:06:51 Last Updated: 2024-08-04T01:01:57.457Z Vendors: n/a Products: n/a Problem Types: n/a Description: In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing - https://blog.hackingforce.com.br/en/cve-2021-36568/ - ht
m/drive/folders/1_fO4BKpmD3avGYHSzvIXWs5owqVYgB1s?usp=sharing - https://blog.hackingforce.com.br/en/cve-2021-36568/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PRI4ETMQ4DJR3TZUOOGPBQ32RBD5LNGC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ERQ3NHVOK4ZXT4MS4LBQ2ZJHTON3LIMW/
CVE ID: CVE-2021-36569 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:16:44.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/daylightstudio/FUEL-CMS/issues/578
CVE ID: CVE-2021-36570 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T16:15:48.352Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/daylightstudio/FUEL-CMS/issues/579
CVE ID: CVE-2021-36572 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T18:47:03.665Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/58
CVE ID: CVE-2021-36573 State: PUBLISHED Published: 2022-12-15T00:00:00.000Z Last Updated: 2025-04-21T18:46:05.325Z Vendors: n/a Products: n/a Problem Types: n/a Description: File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/liufee/cms/issues/59
CVE ID: CVE-2021-36580 State: PUBLISHED Published: 2023-07-27T00:00:00 Last Updated: 2024-10-23T13:05:42.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://icewarp.com - http://mail.ziyan.com - https://medium.com/%40rohitgautam26/cve-2021-36580-69219798231c
CVE ID: CVE-2021-36581 State: PUBLISHED Published: 2021-09-14T11:40:03 Last Updated: 2024-08-04T01:01:57.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file extension to the server. The server does not verify the extension of the file and the tester was able to upload an aspx to the server. Additional Analyst Notes: - CVE Program Container: References: - http://kooboo.com - https://github.com/l00neyhacker/CVE-2021-36581/
CVE ID: CVE-2021-36582 State: PUBLISHED Published: 2021-09-14T11:38:58 Last Updated: 2024-08-04T01:01:57.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Kooboo CMS 2.1.1.0, it is possible to upload a remote shell (e.g., aspx) to the server and then call upon it to receive a reverse shell from the victim server. The files are uploaded to /Content/Template/root/reverse-shell.aspx and can be simply triggered by browsing that URL. Additional Analyst Notes: - CVE Program Container: References: - http://kooboo.com - https://github.com/l00neyhacker/CVE-2021-36582
CVE ID: CVE-2021-36584 State: PUBLISHED Published: 2021-08-05T19:08:32 Last Updated: 2024-08-04T01:01:58.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in GPAC 1.0.1. There is a heap-based buffer overflow in the function gp_rtp_builder_do_tx3g function in ietf/rtp_pck_3gpp.c, as demonstrated by MP4Box. This can cause a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1842
CVE ID: CVE-2021-36593 State: REJECTED Published: N/A Last Updated: 2024-05-02T21:17:22.890858 Description: No description available.
CVE ID: CVE-2021-36594 State: REJECTED Published: N/A Last Updated: 2024-05-02T21:18:09.818367 Description: No description available.
CVE ID: CVE-2021-36601 State: PUBLISHED Published: 2021-08-10T14:05:05 Last Updated: 2024-08-04T01:01:57.777Z Vendors: n/a Products: n/a Problem Types: n/a Description: GetSimpleCMS 3.3.16 contains a cross-site Scripting (XSS) vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kk98kk0/exploit/blob/dbd10a47b0585ba4c673c952a280d502294cdbf4/GetSimpleCMS-3.3.16-xss.md
CVE ID: CVE-2021-36603 State: PUBLISHED Published: 2023-01-09T00:00:00.000Z Last Updated: 2025-04-09T14:38:55.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Friendly Name 1". Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/arendst/Tasmota/issues/12221
CVE ID: CVE-2021-36605 State: PUBLISHED Published: 2021-07-27T14:57:46 Last Updated: 2024-08-04T01:01:57.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/3xxx/engineercms/issues/52
CVE ID: CVE-2021-36608 State: PUBLISHED Published: 2022-06-16T20:36:28 Last Updated: 2024-08-04T01:01:58.399Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in webTareas 2.2p1 via the Name field to /projects/editproject.php. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/webtareas/tickets/44/