rainbutterfly/cve_corpus huggingface dataset:
CVE-2020-20915 
SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSiteAdminControl.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2020-20918 
An issue discovered in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary php code via the hidden parameter to admin.php when editing a page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-20919 
File upload vulnerability in Pluck CMS v.4.7.10-dev2 allows a remote attacker to execute arbitrary code and access sensitive information via the theme.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-20943 
A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T20:32:57.000Z
CVE-2020-20944 
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T20:32:58.000Z
CVE-2020-20945 
A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T20:32:58.000Z
CVE-2020-20946 
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T20:32:59.000Z
CVE-2020-20948 
An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T20:33:01.000Z
CVE-2020-20949 
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-20T15:42:18.000Z
CVE-2020-20950 
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-19T12:22:55.000Z
CVE-2020-20951 
In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-18T15:32:47.000Z
CVE-2020-20969 
File Upload vulnerability in PluckCMS v.4.7.10 allows a remote attacker to execute arbitrary code via the trashcan_restoreitem.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-20971 
Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-01T14:31:58.000Z
CVE-2020-20975 
In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T14:49:18.000Z
CVE-2020-20977 
A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T14:49:19.000Z
CVE-2020-20979 
An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T14:49:20.000Z
CVE-2020-20981 
A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T14:49:21.000Z
CVE-2020-20982 
Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-03T16:07:28.000Z
CVE-2020-20988 
A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T21:07:56.000Z
CVE-2020-20989 
A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T21:07:57.000Z
CVE-2020-20990 
A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-12T21:07:58.000Z
CVE-2020-21003 
Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T14:00:28.000Z
CVE-2020-21005 
WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because the upload file type is controllable, the user can modify the upload file type to get webshell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-03T13:54:30.000Z
CVE-2020-21012 
Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T18:21:53.000Z
CVE-2020-21013 
emlog v6.0.0 contains a SQL injection via /admin/comment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T18:21:54.000Z
CVE-2020-21014 
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T18:21:55.000Z
CVE-2020-21016 
D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary code as root via HNAP1/control/SetGuestWLanSettings.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-31T00:00:00.000Z
CVE-2020-21038 
Open redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-05-08T00:00:00.000Z
CVE-2020-21041 
Buffer Overflow vulnerability exists in FFmpeg 4.1 via apng_do_inverse_blend in libavcodec/pngenc.c, which could let a remote malicious user cause a Denial of Service
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-24T17:31:03.000Z
CVE-2020-21046 
A local privilege escalation vulnerability was identified within the "luminati_net_updater_win_eagleget_com" service in EagleGet Downloader version 2.1.5.20 Stable. This issue allows authenticated non-administrative user to escalate their privilege and conduct code execution as a SYSTEM privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-24T15:11:58.000Z
CVE-2020-21047 
The libcpu component which is used by libasm of elfutils version 0.177 (git 47780c9e), suffers from denial-of-service vulnerability caused by application crashes due to out-of-bounds write (CWE-787), off-by-one error (CWE-193) and reachable assertion (CWE-617); to exploit the vulnerability, the attackers need to craft certain ELF files which bypass the missing bound checks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-22T00:00:00.000Z
CVE-2020-21048 
An issue in the dither.c component of libsixel prior to v1.8.4 allows attackers to cause a denial of service (DOS) via a crafted PNG file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-14T15:09:26.000Z
CVE-2020-21049 
An invalid read in the stb_image.h component of libsixel prior to v1.8.5 allows attackers to cause a denial of service (DOS) via a crafted PSD file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-14T15:09:28.000Z
CVE-2020-21050 
Libsixel prior to v1.8.3 contains a stack buffer overflow in the function gif_process_raster at fromgif.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-14T15:09:29.000Z
CVE-2020-21052 
Cross Site Scripting vulnerability in zrlog zrlog v.2.1.3 allows a remote attacker to execute arbitrary code via the nickame parameter of the /post/addComment function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-21053 
Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "query_string" variable in app\devices\device_imports.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T14:47:31.000Z
CVE-2020-21054 
Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\vars_textarea.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T15:31:43.000Z
CVE-2020-21055 
A Directory Traversal vulnerability exists in FusionPBX 4.5.7 allows malicoius users to rename any file of the system.via the (1) folder, (2) filename, and (3) newfilename variables in app\edit\filerename.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T15:42:13.000Z
CVE-2020-21056 
Directory Traversal vulnerability exists in FusionPBX 4.5.7, which allows a remote malicious user to create folders via the folder variale to app\edit\foldernew.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T15:46:10.000Z
CVE-2020-21057 
Directory Traversal vulnerability in FusionPBX 4.5.7, which allows a remote malicious user to delete folders on the system via the folder variable to app/edit/folderdelete.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-05-20T15:51:48.000Z
CVE-2020-21058 
Cross Site Scripting vulnerability in Typora v.0.9.79 allows a remote attacker to execute arbitrary code via the mermaid sytax.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-21060 
SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrator management page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-04T00:00:00.000Z
CVE-2020-21066 
An issue was discovered in Bento4 v1.5.1.0. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a denial of service (program crash), as demonstrated by mp42aac.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-08-13T20:38:40.000Z
CVE-2020-21081 
A cross-site request forgery (CSRF) in Maccms 8.0 causes administrators to add and modify articles without their knowledge via clicking on a crafted URL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-14T15:57:33.000Z
CVE-2020-21082 
A cross-site scripting (XSS) vulnerability in the background administrator article management module of Maccms 8.0 allows attackers to steal administrator and user cookies via crafted payloads in the text fields for Chinese and English names.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-14T15:57:35.000Z
CVE-2020-21087 
Cross Site Scripting (XSS) in X2Engine X2CRM v6.9 and older allows remote attackers to execute arbitrary code by injecting arbitrary web script or HTML via the "New Name" field of the "Rename a Module" tool.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:49:30.000Z
CVE-2020-21088 
Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the "First Name" and "Last Name" fields in "/index.php/contacts/create page"
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-14T13:49:44.000Z
CVE-2020-21101 
Cross Site Scriptiong vulnerabilityin Screenly screenly-ose all versions, including v1.8.2 (2019-09-25-Screenly-OSE-lite.img), in the 'Add Asset' page via manipulation of a 'URL' field, which could let a remote malicious user execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-04-29T16:57:44.000Z
CVE-2020-21119 
SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin_update_module_widgets.php in recordIDValue parameter, allows attackers to gain escalated privileges and execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2020-21120 
SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_cart parameter to /index.php/cart/num.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2020-21121 
Pligg CMS 2.0.2 contains a time-based SQL injection vulnerability via the $recordIDValue parameter in the admin_update_module_widgets.php file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T16:16:43.000Z
CVE-2020-21122 
UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T16:16:44.000Z
CVE-2020-21124 
UReport 2.2.9 allows attackers to execute arbitrary code due to a lack of access control to the designer page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T16:16:46.000Z
CVE-2020-21125 
An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T16:16:46.000Z
CVE-2020-21126 
MetInfo 7.0.0 contains a Cross-Site Request Forgery (CSRF) via admin/?n=admin&c=index&a=doSaveInfo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T16:16:47.000Z
CVE-2020-21127 
MetInfo 7.0.0 contains a SQL injection vulnerability via admin/?n=logs&c=index&a=dodel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-15T16:16:48.000Z
CVE-2020-21130 
Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-21T15:16:52.000Z
CVE-2020-21131 
SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=language_web&a=doAddLanguage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T12:45:35.000Z
CVE-2020-21132 
SQL Injection vulnerability in Metinfo 7.0.0beta in index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T12:45:44.000Z
CVE-2020-21133 
SQL Injection vulnerability in Metinfo 7.0.0 beta in member/getpassword.php?lang=cn&a=dovalid.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-07-12T12:45:51.000Z
CVE-2020-21139 
EC Cloud E-Commerce System v1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add admin accounts via /admin.html?do=user&act=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-04T19:09:11.000Z
CVE-2020-21141 
iCMS v7.0.15 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admincp.php?app=members&do=add.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T21:57:32.000Z
CVE-2020-21142 
Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-28T19:08:10.000Z
CVE-2020-21146 
Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-21T20:42:13.000Z
CVE-2020-21147 
RockOA V1.9.8 is affected by a cross-site scripting (XSS) vulnerability which allows remote attackers to send malicious code to the administrator and execute JavaScript code, because webmain/flow/input/mode_emailmAction.php does not perform strict filtering.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-01-21T20:42:43.000Z
CVE-2020-21152 
SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunction.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-20T00:00:00.000Z
CVE-2020-21161 
Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-27T14:56:39.000Z
CVE-2020-21174 
File Upload vulenrability in liufee CMS v.2.0.7.1 allows a remote attacker to execute arbitrary code via the image suffix function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-21176 
SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T17:37:56.000Z
CVE-2020-21179 
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signin page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T17:38:00.000Z
CVE-2020-21180 
Sql injection vulnerability in koa2-blog 1.0.0 allows remote attackers to Injecting a malicious SQL statement via the name parameter to the signup page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-01T17:38:05.000Z
CVE-2020-21219 
Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-15T00:00:00.000Z
CVE-2020-21224 
A Remote Code Execution vulnerability has been found in Inspur ClusterEngine V4.0. A remote attacker can send a malicious login packet to the control server
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-02-22T15:00:07.000Z
CVE-2020-21228 
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T20:49:52.000Z
CVE-2020-21236 
A vulnerability in /damicms-master/admin.php?s=/Article/doedit of DamiCMS v6.0 allows attackers to compromise and impersonate user accounts via obtaining a user's session cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T22:22:58.000Z
CVE-2020-21237 
An issue in the user login box of LJCMS v1.11 allows attackers to hijack user accounts via brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T22:22:59.000Z
CVE-2020-21238 
An issue in the user login box of CSCMS v4.0 allows attackers to hijack user accounts via brute force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-27T22:23:00.000Z
CVE-2020-21244 
An issue was discovered in FrontAccounting 2.4.7. There is a Directory Traversal vulnerability that can empty folder via admin/inst_lang.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-09-30T14:06:32.000Z
CVE-2020-21246 
Cross Site Scripting vulnerability in YiiCMS v.1.0 allows a remote attacker to execute arbitrary code via the news function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-21250 
CSZ CMS v1.2.4 was discovered to contain an arbitrary file upload vulnerability in the component /core/MY_Security.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-27T19:00:18.000Z
CVE-2020-21252 
Cross Site Request Forgery vulnerability in Neeke HongCMS 3.0.0 allows a remote attacker to execute arbitrary code and escalate privileges via the updateusers parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-21266 
Broadleaf Commerce 5.1.14-GA is affected by cross-site scripting (XSS) due to a slow HTTP post vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-10-29T13:32:27.000Z
CVE-2020-21268 
Cross Site Scripting vulnerability in EasySoft ZenTao v.11.6.4 allows a remote attacker to execute arbitrary code via the lastComment parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-06-20T00:00:00.000Z
CVE-2020-21316 
A Cross-site scripting (XSS) vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-06-15T17:15:24.000Z