Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2021-44921 State: PUBLISHED Published: 2021-12-21T20:19:55 Last Updated: 2024-08-04T04:32:13.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_isom_parse_movie_boxes_internal function, which causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1964
CVE ID: CVE-2021-44922 State: PUBLISHED Published: 2021-12-21T20:22:38 Last Updated: 2024-08-04T04:32:13.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the BD_CheckSFTimeOffset function, which causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1969
CVE ID: CVE-2021-44923 State: PUBLISHED Published: 2021-12-21T20:25:01 Last Updated: 2024-08-04T04:32:13.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_dump_vrml_dyn_field.isra function, which causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1962
CVE ID: CVE-2021-44924 State: PUBLISHED Published: 2021-12-21T20:28:01 Last Updated: 2024-08-04T04:32:13.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: An infinite loop vulnerability exists in gpac 1.1.0 in the gf_log function, which causes a Denial of Service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1959
CVE ID: CVE-2021-44925 State: PUBLISHED Published: 2021-12-21T20:31:11 Last Updated: 2024-08-04T04:32:13.265Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_svg_get_attribute_name function, which causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1967
CVE ID: CVE-2021-44926 State: PUBLISHED Published: 2021-12-21T20:35:22 Last Updated: 2024-08-04T04:32:13.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in gpac 1.1.0-DEV in the gf_node_get_tag function, which causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1961
CVE ID: CVE-2021-44927 State: PUBLISHED Published: 2021-12-21T20:38:56 Last Updated: 2024-08-04T04:32:13.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: A null pointer dereference vulnerability exists in gpac 1.1.0 in the gf_sg_vrml_mf_append function, which causes a segmentation fault and application crash. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/gpac/gpac/issues/1960
CVE ID: CVE-2021-44935 State: PUBLISHED Published: 2021-12-14T12:03:59 Last Updated: 2024-08-04T04:32:13.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: glFusion CMS v1.7.9 is affected by an arbitrary user impersonation vulnerability in /public_html/comment.php. The attacker can complete the attack remotely without interaction. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glFusion/glfusion/issues/482
CVE ID: CVE-2021-44937 State: PUBLISHED Published: 2021-12-14T12:43:21 Last Updated: 2024-08-04T04:32:13.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: glFusion CMS v1.7.9 is affected by an arbitrary user registration vulnerability in /public_html/users.php. An attacker can register with the mailbox of any user. When users want to register, they will find that the mailbox has been occupied. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glFusion/glfusion/issues/485
CVE ID: CVE-2021-44942 State: PUBLISHED Published: 2021-12-14T20:06:25 Last Updated: 2024-08-04T04:32:13.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: glFusion CMS 1.7.9 is affected by a Cross Site Request Forgery (CSRF) vulnerability in /public_html/admin/plugins/bad_behavior2/blacklist.php. Using the CSRF vulnerability to trick the administrator to click, an attacker can add a blacklist. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glFusion/glfusion/issues/486
CVE ID: CVE-2021-44948 State: REJECTED Published: 2021-12-14T20:00:14 Last Updated: 2021-12-30T10:38:34 Description: No description available.
CVE ID: CVE-2021-44949 State: PUBLISHED Published: 2021-12-14T14:14:05 Last Updated: 2024-08-04T04:32:13.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: glFusion CMS 1.7.9 is affected by an access control vulnerability via /public_html/users.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glFusion/glfusion/issues/487
CVE ID: CVE-2021-44954 State: PUBLISHED Published: 2022-07-17T23:27:18 Last Updated: 2024-08-04T04:32:13.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QVIS NVR DVR before 2021-12-13, an attacker can escalate privileges from a qvisdvr user to the root user by abusing a Sudo misconfiguration. Additional Analyst Notes: - CVE Program Container: References: - https://twitter.com/Me9187/status/1414906288287404039 - https://gist.github.com/Meeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee/a670418d51051d4e6513d86e84e8d5b8
CVE ID: CVE-2021-44956 State: PUBLISHED Published: 2022-02-08T14:13:22 Last Updated: 2024-08-04T04:32:13.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: Two Heap based buffer overflow vulnerabilities exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23852. Issues that are in the jfif_decode function at ffjpeg/src/jfif.c (line 552) could cause a Denial of Service by using a crafted jpeg file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/43
CVE ID: CVE-2021-44957 State: PUBLISHED Published: 2022-02-08T14:10:58 Last Updated: 2024-08-04T04:32:13.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Global buffer overflow vulnerability exist in ffjpeg through 01.01.2021. It is similar to CVE-2020-23705. Issue is in the jfif_encode function at ffjpeg/src/jfif.c (line 708) could cause a Denial of Service by using a crafted jpeg file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rockcarry/ffjpeg/issues/44
CVE ID: CVE-2021-44960 State: PUBLISHED Published: 2022-02-15T00:00:00.000Z Last Updated: 2025-11-03T17:30:47.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the renderDocument function handled the XMLDocument object improperly, returning a null pointer in advance at the second if, resulting in a null pointer reference behind the renderDocument function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/svgpp/svgpp/issues/101 - https://github.com/svgpp/svgpp/issues/101.aa - https://lists.debian.org/debian-lts-announce/2023/04/msg00001.html
CVE ID: CVE-2021-44961 State: PUBLISHED Published: 2022-03-01T01:45:47 Last Updated: 2024-08-04T04:32:13.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: A memory leakage flaw exists in the class PerimeterGenerator of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. Specially crafted stl files can exhaust available memory. An attacker can provide malicious files to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - http://libslic3r.com - http://slic3r.com - https://hackmd.io/nDT_UKLyRQendxDwil9A4w
CVE ID: CVE-2021-44962 State: PUBLISHED Published: 2022-03-01T01:54:52 Last Updated: 2024-08-04T04:32:13.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An out-of-bounds read vulnerability exists in the GCode::extrude() functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially crafted stl file could lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://hackmd.io/KSI1bwGfSyO7T8UCf0HeTw - https://slic3r.org
CVE ID: CVE-2021-44964 State: PUBLISHED Published: 2022-03-14T14:24:51 Last Updated: 2024-08-04T04:32:13.466Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use after free in garbage collector and finalizer of lgc.c in Lua interpreter 5.4.0~5.4.3 allows attackers to perform Sandbox Escape via a crafted script file. Additional Analyst Notes: - CVE Program Container: References: - http://lua-users.org/lists/lua-l/2021-11/msg00186.html - http://lua-users.org/lists/lua-l/2021-12/msg00007.html - http://lua-users.org/lists/lua-l/2021-12/msg00015.html - http://lua-users.org/lists/lua-l/2021-12/msg00030.html - https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability
CVE ID: CVE-2021-44965 State: PUBLISHED Published: 2021-12-13T14:43:24 Last Updated: 2024-08-04T04:32:13.547Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in /admin/includes/* directory for PHPGURUKUL Employee Record Management System 1.2 The attacker can retrieve and download sensitive information from the vulnerable server. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System
CVE ID: CVE-2021-44966 State: PUBLISHED Published: 2021-12-13T14:20:43 Last Updated: 2024-08-04T04:32:13.611Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection bypass authentication vulnerability in PHPGURUKUL Employee Record Management System 1.2 via index.php. An attacker can log in as an admin account of this system and can destroy, change or manipulate all sensitive information on the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/PHPGURUKUL/ANUJ%20KUMAR/Employee-Record-Management-System-SQL-Injection-Bypass-Authentication
CVE ID: CVE-2021-44967 State: PUBLISHED Published: 2022-02-22T21:17:32.000Z Last Updated: 2025-02-20T03:12:37.814Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. NOTE: the Supplier's position is that plugins intentionally can contain arbitrary PHP code, and can only be installed by a superadmin, and therefore the security model is not violated by this finding. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50573 - https://github.com/Y1LD1R1
yst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/50573 - https://github.com/Y1LD1R1M-1337/Limesurvey-RCE - https://www.limesurvey.org/manual/Plugins_-_advanced
CVE ID: CVE-2021-44968 State: PUBLISHED Published: 2022-02-18T17:25:16 Last Updated: 2024-08-04T04:32:13.469Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Use after Free vulnerability exists in IOBit Advanced SystemCare 15 pro via requests sent in sequential order using the IOCTL driver codes, which could let a malicious user execute arbitrary code or a Denial of Service (system crash). IOCTL list: iobit_ioctl = [0x8001e01c, 0x8001e020, 0x8001e024, 0x8001e040,0x8001e044, 0x8001e048, 0x8001e04c, 0x8001e000, 0x8001e004, 0x8001e008, 0x8001e00c, 0x8001e010, 0x8001e014, 0x8001e018] Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research
01e014, 0x8001e018] Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/iobit_advenced_system_care
CVE ID: CVE-2021-44969 State: PUBLISHED Published: 2022-02-10T22:39:10 Last Updated: 2024-08-04T04:32:13.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/9
CVE ID: CVE-2021-44970 State: PUBLISHED Published: 2022-02-10T22:39:11 Last Updated: 2024-08-04T04:32:13.470Z Vendors: n/a Products: n/a Problem Types: n/a Description: MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bg5sbk/MiniCMS/issues/43
CVE ID: CVE-2021-44971 State: PUBLISHED Published: 2022-01-28T18:17:04 Last Updated: 2024-08-04T04:32:13.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple Tenda devices are affected by authentication bypass, such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information, and even combine it with authenticated command injection to implement RCE. Additional Analyst Notes: - CVE Program Container: References: - http://tenda.com - http://ac15v10.com - https://github.com/21Gun5/my_cve/blob/main/tenda/bypass_auth.md
CVE ID: CVE-2021-44974 State: PUBLISHED Published: 2022-05-25T11:56:49 Last Updated: 2024-08-04T04:32:13.607Z Vendors: n/a Products: n/a Problem Types: n/a Description: radareorg radare2 version 5.5.2 is vulnerable to NULL Pointer Dereference via libr/bin/p/bin_symbols.c binary symbol parser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radareorg/radare2/issues/19478 - https://census-labs.com/news/2022/05/24/multiple-vulnerabilities-in-radare2/ - http://www.openwall.com/lists/oss-security/2022/05/25/1
CVE ID: CVE-2021-44975 State: PUBLISHED Published: 2022-05-24T14:40:08 Last Updated: 2024-08-04T04:32:13.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: radareorg radare2 5.5.2 is vulnerable to Buffer Overflow via /libr/core/anal_objc.c mach-o parser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/radareorg/radare2/issues/19476 - https://census-labs.com/news/2022/05/24/multiple-vulnerabilities-in-radare2/ - http://www.openwall.com/lists/oss-security/2022/05/25/1
CVE ID: CVE-2021-44977 State: PUBLISHED Published: 2022-02-04T15:35:33 Last Updated: 2024-08-04T04:32:13.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: In iCMS <=8.0.0, a directory traversal vulnerability allows an attacker to read arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%960day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE ID: CVE-2021-44978 State: PUBLISHED Published: 2022-02-04T15:29:52 Last Updated: 2024-08-04T04:32:13.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: iCMS <= 8.0.0 allows users to add and render a comtom template, which has a SSTI vulnerability which causes remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.icmsdev.com/ - https://gem-love.com/2021/12/10/ICMS-8-0-0%E5%90%8E%E5%8F%B0%E6%A8%A1%E6%9D%BF%E6%B3%A8%E5%85%A5%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C0day%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90/
CVE ID: CVE-2021-44981 State: PUBLISHED Published: 2022-01-24T12:26:11 Last Updated: 2024-08-04T04:32:13.597Z Vendors: n/a Products: n/a Problem Types: n/a Description: In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function, which allows for privilege escalation by means of RCE. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/blog/61b2b37a
lation by means of RCE. Additional Analyst Notes: - CVE Program Container: References: - https://websec.nl/blog/61b2b37a43a1155c848f3b08/websec%20finds%20critical%20vulnerabilities%20in%20popular%20media%20server - https://github.com/QuickBox/QB/issues/202
CVE ID: CVE-2021-44983 State: PUBLISHED Published: 2022-02-04T13:57:59 Last Updated: 2024-08-04T04:32:13.622Z Vendors: n/a Products: n/a Problem Types: n/a Description: In taocms 3.0.1 after logging in to the background, there is an Arbitrary file download vulnerability at the File Management column. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/10
CVE ID: CVE-2021-44988 State: PUBLISHED Published: 2022-01-25T00:23:51 Last Updated: 2024-08-04T04:32:13.487Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jerryscript v3.0.0 and below was discovered to contain a stack overflow via ecma_find_named_property in ecma-helpers.c. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://github.com/jerryscript-project/jerryscript/issues/4890 - https://github.com/jerryscript-project/jerryscript/issues/4891
CVE ID: CVE-2021-44992 State: PUBLISHED Published: 2022-01-25T00:23:52 Last Updated: 2024-08-04T04:32:13.618Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion ''ecma_object_is_typedarray (obj_p)'' failed at /jerry-core/ecma/operations/ecma-typedarray-object.c in Jerryscript 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://github.com/jerryscript-project/jerryscript/issues/4875
CVE ID: CVE-2021-44993 State: PUBLISHED Published: 2022-01-25T00:23:53 Last Updated: 2024-08-04T04:32:13.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion ''ecma_is_value_boolean (base_value)'' failed at /jerry-core/ecma/operations/ecma-get-put-value.c in Jerryscript 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://github.com/jerryscript-project/jerryscript/issues/4876
CVE ID: CVE-2021-44994 State: PUBLISHED Published: 2022-01-25T00:23:55 Last Updated: 2024-08-04T04:32:13.503Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an Assertion ''JERRY_CONTEXT (jmem_heap_allocated_size) == 0'' failed at /jerry-core/jmem/jmem-heap.c in Jerryscript 3.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://security.samsungmobile.com/securityUpdate.smsb - https://github.com/jerryscript-project/jerryscript/issues/4894 - https://github.com/jerryscript-project/jerryscript/issues/4895
CVE ID: CVE-2021-45003 State: PUBLISHED Published: 2022-01-10T12:19:26 Last Updated: 2024-08-04T04:32:13.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Laundry Booking Management System 1.0 (Latest) and previous versions are affected by a remote code execution (RCE) vulnerability in profile.php through the "image" parameter that can execute a webshell payload. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/drive/folders/1VuWo2JS7VTh9KPRnoi7CZZQgVZ4msBav?usp=sharing - https://github.com/qerogram/BUG_WEB/tree/main/OpenSource/CVE-2021-45003
CVE ID: CVE-2021-45005 State: PUBLISHED Published: 2022-02-14T21:47:16 Last Updated: 2024-08-04T04:32:13.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: Artifex MuJS v1.1.3 was discovered to contain a heap buffer overflow which is caused by conflicting JumpList of nested try/finally statements. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.ghostscript.com/show_bug.cgi?id=704749 - https://github.com/ccxvii/mujs/commit/df8559e7bdbc6065276e786217eeee70f28fce66
CVE ID: CVE-2021-45007 State: PUBLISHED Published: 2022-02-20T11:13:54 Last Updated: 2024-08-04T04:32:13.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plesk 18.0.37 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows an attacker to insert data on the user and admin panel. NOTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AS4mir/CVE-2021-45007/blob/main/README.md
CVE ID: CVE-2021-45008 State: PUBLISHED Published: 2022-02-21T11:12:50 Last Updated: 2024-08-04T04:32:13.565Z Vendors: n/a Products: n/a Problem Types: n/a Description: Plesk CMS 18.0.37 is affected by an insecure permissions vulnerability that allows privilege Escalation from user to admin rights. OTE: the vendor states that this is only a site-specific problem on websites of one or more Plesk users Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/AS4mir/CVE-2021-45008/blob/main/README.md
CVE ID: CVE-2021-45010 State: PUBLISHED Published: 2022-03-15T11:13:26 Last Updated: 2024-08-04T04:32:13.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/prasathmani/tinyfilemanager/pull/636 - https://github.com/prasathmani/tinyfilemanager/commit/2046bbde72ed76af0cfdcae082de629bcc4b44c7 - https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-aut
ger/commit/2046bbde72ed76af0cfdcae082de629bcc4b44c7 - https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/ - https://github.com/febinrev/tinyfilemanager-2.4.3-exploit/raw/main/exploit.sh - https://sploitus.com/exploit?id=1337DAY-ID-37364&utm_source=rss&utm_medium=rss - https://raw.githubusercontent.com/febinrev/tinyfilemanager-2.4.6-exploit/main/exploit.sh - https://github.com/prasathmani/tinyfilemanager/pull/636/files/a93fc321a3c89fdb9bee860bf6df5d89083298d1 - http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html
CVE ID: CVE-2021-45014 State: PUBLISHED Published: 2021-12-14T13:32:03 Last Updated: 2024-08-04T04:32:13.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: There is an upload sql injection vulnerability in the background of taocms 3.0.2 in parameter id:action=cms&ctrl=update&id=26 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/11
CVE ID: CVE-2021-45015 State: PUBLISHED Published: 2021-12-14T13:36:55 Last Updated: 2024-08-04T04:32:13.617Z Vendors: n/a Products: n/a Problem Types: n/a Description: taocms 3.0.2 is vulnerable to arbitrary file deletion via taocms\include\Model\file.php from line 60 to line 72. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/taogogo/taocms/issues/12
CVE ID: CVE-2021-45017 State: PUBLISHED Published: 2021-12-15T22:18:29 Last Updated: 2024-08-04T04:32:13.686Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Request Forgery (CSRF) vulnerability exits in Catfish <=6.1.* when you upload an html file containing CSRF on the website that uses a google editor; you can specify the menu url address as your malicious url address in the Add Menu column. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwlrbh/Catfish/issues/8
CVE ID: CVE-2021-45018 State: PUBLISHED Published: 2021-12-15T22:24:42 Last Updated: 2024-08-04T04:32:13.602Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor (the file suffix is allowed). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xwlrbh/Catfish/issues/9