deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-42536
Published: 2021-10-22
Description: The affected product is vulnerable to a disclosure of peer username and password by allowing all users access to read global variables.
CVSS Score: 8.0 (HIGH)
CWE: CWE-200, CWE-668
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02
CVE: CVE-2021-42538
Published: 2021-10-22
Description: The affected product is vulnerable to a parameter injection via passphrase, which enables the attacker to supply uncontrolled input.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78, CWE-77
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02
CVE: CVE-2021-42539
Published: 2021-10-22
Description: The affected product is vulnerable to a missing permission validation on system backup restore, which could lead to account take over and unapproved settings change.
CVSS Score: 8.0 (HIGH)
CWE: CWE-306
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02
CVE: CVE-2021-42540
Published: 2021-10-22
Description: The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.
CVSS Score: 8.0 (HIGH)
CWE: CWE-123
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02
CVE: CVE-2021-42542
Published: 2021-10-22
Description: The affected product is vulnerable to directory traversal due to mishandling of provided backup folder structure.
CVSS Score: 8.0 (HIGH)
CWE: CWE-22
References: https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02; https://us-cert.cisa.gov/ics/advisories/icsa-21-278-02
CVE: CVE-2021-42836
Published: 2021-10-22
Description: GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://github.com/tidwall/gjson/commit/590010fdac311cc8990ef5c97448d4fec8f29944; https://github.com/tidwall/gjson/commit/77a57fda87dca6d0d7d4627d512a630f89a91c96; https://github.com/tidwall/gjson/compare/v1.9.2...v1.9.3
CVE: CVE-2021-29835
Published: 2021-10-22
Description: IBM Business Automation Workflow 18.0, 19.0, 20.0, and 21.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204833.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204833; https://www.ibm.com/support/pages/node/6507319; https://exchange.xforce.ibmcloud.com/vulnerabilities/204833
CVE: CVE-2021-41171
Published: 2021-10-22
Description: eLabFTW is an open source electronic lab notebook manager for research teams. In versions of eLabFTW before 4.1.0, it allows attackers to bypass a brute-force protection mechanism by using many different forged PHPSESSID values in HTTP Cookie header. This issue has been addressed by implementing brute force login protection, as recommended by Owasp with Device Cookies. This mechanism will not impact users and will effectively thwart any brute-force attempts at guessing passwords. The only correct way to address this is to upgrade to version 4.1.0. Adding rate limitation upstream of the eLabFTW service is of course a valid option, with or without upgrading.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-307
References: https://github.com/elabftw/elabftw/commit/8e92afeec4c3a68dc88333881b7e6307f425706b; https://github.com/elabftw/elabftw/releases/tag/4.1.0; https://github.com/elabftw/elabftw/security/advisories/GHSA-q67h-5pc3-g6jv
CVE: CVE-2021-42556
Published: 2021-10-22
Description: Rasa X before 0.42.4 allows Directory Traversal during archive extraction. In the functionality that allows a user to load a trained model archive, an attacker has arbitrary write capability within specific directories via a crafted archive file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://github.com/RasaHQ/rasa-x-security-advisories/security/advisories/GHSA-vp2h-j6px-56rc; https://rasa.com; https://github.com/RasaHQ/rasa-x-security-advisories/security/advisories/GHSA-vp2h-j6px-56rc
CVE: CVE-2021-42840
Published: 2021-10-22
Description: SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover, logger_file_name can refer to an attacker-controlled PHP file under the web root, because only the all-lowercase PHP file extensions were blocked. NOTE: this issue exists because of an incomplete fix for CVE-2020-28328.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: http://packetstormsecurity.com/files/165001/SuiteCRM-7.11.18-Remote-Code-Execution.html; https://docs.suitecrm.com/admin/releases/7.11.x/#_7_11_19; https://github.com/rapid7/metasploit-framework/commits/master/modules/exploits/linux/http/suitecrm_log_file_rce.rb
CVE: CVE-2020-23036
Published: 2021-10-22
Description: MEDIA NAVI Inc SMACom v1.2 was discovered to contain an insecure session validation vulnerability in the session handling of the `password` authentication parameter of the wifi photo transfer module. This vulnerability allows attackers with network access privileges or on public wifi networks to read the authentication credentials and follow-up requests containing the user password via a man in the middle attack.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-522
References: https://cwe.mitre.org/data/definitions/522.html; https://www.vulnerability-lab.com/get_content.php?id=2211; https://cwe.mitre.org/data/definitions/522.html
CVE: CVE-2020-23037
Published: 2021-10-22
Description: Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://www.vulnerability-lab.com/get_content.php?id=2198; https://www.vulnerability-lab.com/get_content.php?id=2198
CVE: CVE-2020-23038
Published: 2021-10-22
Description: Swift File Transfer Mobile v1.1.2 and below was discovered to contain an information disclosure vulnerability in the path parameter. This vulnerability is exploited via an error caused by including non-existent path environment variables.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.vulnerability-lab.com/get_content.php?id=2205; https://www.vulnerability-lab.com/get_content.php?id=2205
CVE: CVE-2020-23039
Published: 2021-10-22
Description: Folder Lock v3.4.5 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Create Folder function under the 'create' module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload as a path or folder name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2210; https://www.vulnerability-lab.com/get_content.php?id=2210
CVE: CVE-2020-23040
Published: 2021-10-22
Description: Sky File v2.1.0 contains a directory traversal vulnerability in the FTP server which allows attackers to access sensitive data and files via 'null' path commands.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.vulnerability-lab.com/get_content.php?id=2207; https://www.vulnerability-lab.com/get_content.php?id=2207
CVE: CVE-2020-23041
Published: 2021-10-22
Description: Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2204; https://www.vulnerability-lab.com/get_content.php?id=2204
CVE: CVE-2020-23042
Published: 2021-10-22
Description: Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability in the path parameter of the `list` and `download` module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2201; https://www.vulnerability-lab.com/get_content.php?id=2201
CVE: CVE-2020-23043
Published: 2021-10-22
Description: Tran Tu Air Sender v1.0.2 was discovered to contain an arbitrary file upload vulnerability in the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-434
References: https://www.vulnerability-lab.com/get_content.php?id=2212; https://www.vulnerability-lab.com/get_content.php?id=2212
CVE: CVE-2020-23044
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_pic_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2195; https://www.vulnerability-lab.com/get_content.php?id=2195
CVE: CVE-2020-23045
Published: 2021-10-22
Description: Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a SQL injection vulnerability via the 'roleId' parameter of the `editRole` and `deletUser` modules.
CVSS Score: 7.2 (HIGH)
CWE: CWE-89
References: https://www.vulnerability-lab.com/get_content.php?id=2206; https://www.vulnerability-lab.com/get_content.php?id=2206
CVE: CVE-2020-23046
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tpl.php via the `filename`, `mid`, `userid`, and `templet' parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2194; https://www.vulnerability-lab.com/get_content.php?id=2194
CVE: CVE-2020-23047
Published: 2021-10-22
Description: Macrob7 Macs Framework Content Management System - 1.14f was discovered to contain a cross-site scripting (XSS) vulnerability in the search input field of the search module.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2206; https://www.vulnerability-lab.com/get_content.php?id=2206
CVE: CVE-2020-23048
Published: 2021-10-22
Description: SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the component AddEvent.php via the name and comment parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2209; https://www.vulnerability-lab.com/get_content.php?id=2209
CVE: CVE-2020-23049
Published: 2021-10-22
Description: Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2208; https://www.vulnerability-lab.com/get_content.php?id=2208
CVE: CVE-2020-23050
Published: 2021-10-22
Description: TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code.
CVSS Score: 8.0 (HIGH)
CWE: CWE-74
References: https://cwe.mitre.org/data/definitions/79.html; https://www.vulnerability-lab.com/get_content.php?id=2215; https://cwe.mitre.org/data/definitions/79.html
CVE: CVE-2020-23051
Published: 2021-10-22
Description: Phpgurukul User Registration & User Management System v2.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & loginsystem input fields.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2216; https://www.vulnerability-lab.com/get_content.php?id=2216
CVE: CVE-2020-23052
Published: 2021-10-22
Description: Catalyst IT Ltd Mahara CMS v19.10.2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component groupfiles.php via the Number (Nombre) and Description (Descripción) parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2217; https://www.vulnerability-lab.com/get_content.php?id=2217
CVE: CVE-2020-23054
Published: 2021-10-22
Description: A cross-site scripting (XSS) vulnerability in NSK User Agent String Switcher Service v0.3.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the user agent input field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2189; https://www.vulnerability-lab.com/get_content.php?id=2189
CVE: CVE-2020-23055
Published: 2021-10-22
Description: ANCOM WLAN Controller (Wireless Series & Hotspot) WLC-1000 & WLC-4006 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the /authen/start/ module via the userid and password parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2196; https://www.vulnerability-lab.com/get_content.php?id=2196
CVE: CVE-2020-23058
Published: 2021-10-22
Description: An issue in the authentication mechanism in Nong Ge File Explorer v1.4 unauthenticated allows to access sensitive data.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-287
References: https://cwe.mitre.org/data/definitions/287.html; https://www.vulnerability-lab.com/get_content.php?id=2219; https://cwe.mitre.org/data/definitions/287.html
CVE: CVE-2020-23060
Published: 2021-10-22
Description: Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Export/Import function. This vulnerability allows attackers to escalate local process privileges via a crafted ef2 file.
CVSS Score: 7.1 (HIGH)
CWE: CWE-787
References: https://cwe.mitre.org/data/definitions/121.html; https://www.vulnerability-lab.com/get_content.php?id=2236; https://cwe.mitre.org/data/definitions/121.html
CVE: CVE-2020-23061
Published: 2021-10-22
Description: Dropouts Technologies LLP Super Backup v2.0.5 was discovered to contain an issue in the path parameter of the `list` and `download` module which allows attackers to perform a directory traversal via a change to the path variable to request the local list command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://www.vulnerability-lab.com/get_content.php?id=2200; https://www.vulnerability-lab.com/get_content.php?id=2200
CVE: CVE-2020-28955
Published: 2021-10-22
Description: SugarCRM v6.5.18 was discovered to contain a cross-site scripting (XSS) vulnerability in the Create Employee module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the First Name or Last Name input fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2257; https://www.vulnerability-lab.com/get_content.php?id=2257
CVE: CVE-2020-28956
Published: 2021-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Sales module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2249; https://www.vulnerability-lab.com/get_content.php?id=2249
CVE: CVE-2020-28957
Published: 2021-10-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Customer Add module of Foxlor v0.10.16 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the name, firstname, or username input fields.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2241; https://www.vulnerability-lab.com/get_content.php?id=2241
CVE: CVE-2020-28960
Published: 2021-10-22
Description: Chichen Tech CMS v1.0 was discovered to contain multiple SQL injection vulnerabilities in the file product_list.php via the id and cid parameters.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.vulnerability-lab.com/get_content.php?id=2259; https://www.vulnerability-lab.com/get_content.php?id=2259
CVE: CVE-2020-28961
Published: 2021-10-22
Description: Perfex CRM v2.4.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component ./clients/client via the company name parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2231; https://www.vulnerability-lab.com/get_content.php?id=2231
CVE: CVE-2020-28963
Published: 2021-10-22
Description: Passcovery Co. Ltd ZIP Password Recovery v3.70.69.0 was discovered to contain a buffer overflow via the decompress function.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.vulnerability-lab.com/get_content.php?id=2258; https://www.vulnerability-lab.com/get_content.php?id=2258
CVE: CVE-2020-28964
Published: 2021-10-22
Description: Internet Download Manager 6.37.11.1 was discovered to contain a stack buffer overflow in the Search function. This vulnerability allows attackers to escalate local process privileges via unspecified vectors.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-787
References: https://www.vulnerability-lab.com/get_content.php?id=2236; https://www.vulnerability-lab.com/get_content.php?id=2236
CVE: CVE-2020-28967
Published: 2021-10-22
Description: FlashGet v1.9.6 was discovered to contain a buffer overflow in the 'current path directory' function. This vulnerability allows attackers to elevate local process privileges via overwriting the registers.
CVSS Score: 8.8 (HIGH)
CWE: CWE-120
References: https://www.vulnerability-lab.com/get_content.php?id=2248; https://www.vulnerability-lab.com/get_content.php?id=2248
CVE: CVE-2020-28968
Published: 2021-10-22
Description: Draytek VigorAP 1000C contains a stored cross-site scripting (XSS) vulnerability in the RADIUS Setting - RADIUS Server Configuration module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username input field.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2244; https://www.vulnerability-lab.com/get_content.php?id=2244
CVE: CVE-2020-28969
Published: 2021-10-22
Description: Aplioxio PDF ShapingUp 5.0.0.139 contains a buffer overflow which allows attackers to cause a denial of service (DoS) via a crafted PDF file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.vulnerability-lab.com/get_content.php?id=2260; https://www.vulnerability-lab.com/get_content.php?id=2260
CVE: CVE-2020-36485
Published: 2021-10-22
Description: Portable Ltd Playable v9.18 was discovered to contain an arbitrary file upload vulnerability in the filename parameter of the upload module. This vulnerability allows attackers to execute arbitrary code via a crafted JPEG file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-434
References: https://www.vulnerability-lab.com/get_content.php?id=2198; https://www.vulnerability-lab.com/get_content.php?id=2198
CVE: CVE-2020-36486
Published: 2021-10-22
Description: Swift File Transfer Mobile v1.1.2 and below was discovered to contain a cross-site scripting (XSS) vulnerability via the 'path' parameter of the 'list' and 'download' exception-handling.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2205; https://www.vulnerability-lab.com/get_content.php?id=2205
CVE: CVE-2020-36488
Published: 2021-10-22
Description: An issue in the FTP server of Sky File v2.1.0 allows attackers to perform directory traversal via `/null//` path commands.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: https://www.vulnerability-lab.com/get_content.php?id=2207; https://www.vulnerability-lab.com/get_content.php?id=2207
CVE: CVE-2020-36489
Published: 2021-10-22
Description: Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting (XSS) vulnerability in the devicename parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the devicename information.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2204; https://www.vulnerability-lab.com/get_content.php?id=2204
CVE: CVE-2020-36490
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2195; https://www.vulnerability-lab.com/get_content.php?id=2195
CVE: CVE-2020-36491
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component tags_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2195; https://www.vulnerability-lab.com/get_content.php?id=2195
CVE: CVE-2020-36492
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component select_media.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2195; https://www.vulnerability-lab.com/get_content.php?id=2195
CVE: CVE-2020-36493
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component media_main.php via the `activepath`, `keyword`, `tag`, `fmdo=x&filename`, `CKEditor` and `CKEditorFuncNum` parameters.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2195; https://www.vulnerability-lab.com/get_content.php?id=2195
CVE: CVE-2020-36494
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component mychannel_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2194; https://www.vulnerability-lab.com/get_content.php?id=2194
CVE: CVE-2020-36495
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component file_manage_view.php via the `filename`, `mid`, `userid`, and `templet' parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2194; https://www.vulnerability-lab.com/get_content.php?id=2194
CVE: CVE-2020-36496
Published: 2021-10-22
Description: DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in the component sys_admin_user_edit.php via the `filename`, `mid`, `userid`, and `templet' parameters.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://www.vulnerability-lab.com/get_content.php?id=2194; https://www.vulnerability-lab.com/get_content.php?id=2194