rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-43609 
An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within the order_by_for_ticket function in app/models/reporting/database_query.rb allows an authenticated attacker to execute arbitrary SQL commands via the sort parameter. This can be leveraged to leak local files from the host system, leading to remote code execution (RCE) through deserialization of malicious data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9.9
baseSeverity: CRITICAL
Published: 2023-11-08T00:00:00.000Z
CVE-2021-43610 
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via an invalid From header (request URI without a parameter) in an unauthenticated SIP message, a different issue than CVE-2021-33056.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T21:53:49.000Z
CVE-2021-43611 
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-12T21:53:17.000Z
CVE-2021-43612 
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-15T00:00:00.000Z
CVE-2021-43615 
An issue was discovered in HddPassword in Insyde InsydeH2O with kernel 5.1 before 05.16.23, 5.2 before 05.26.23, 5.3 before 05.35.23, 5.4 before 05.43.22, and 5.5 before 05.51.22. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-03T01:09:57.000Z
CVE-2021-43616 
The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from package.json. This behavior is inconsistent with the documentation, and makes it easier for attackers to install malware that was supposed to have been blocked by an exact version match requirement in package-lock.json. NOTE: The npm team believes this is not a vulnerability. It would require someone to socially engineer package.json which has different dependencies than package-lock.json. That user would have to have file system or write access to change dependencies. The npm team states preventing malicious actors from socially engineering or gaining file system access is outside the scope of the npm CLI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseScore: 9
baseSeverity: CRITICAL
Published: 2021-11-13T00:00:00.000Z
CVE-2021-43617 
Laravel Framework through 8.70.2 does not sufficiently block the upload of executable PHP content because Illuminate/Validation/Concerns/ValidatesAttributes.php lacks a check for .phar files, which are handled as application/x-httpd-php on systems based on Debian. NOTE: this CVE Record is for Laravel Framework, and is unrelated to any reports concerning incorrectly written user applications for image upload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-14T15:32:39.000Z
CVE-2021-43618 
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-15T00:00:00.000Z
CVE-2021-43619 
Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model, a psa_fwu_write caller from SPE or NSPE can overwrite stack memory locations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T04:31:25.000Z
CVE-2021-43620 
An issue was discovered in the fruity crate through 0.2.0 for Rust. Security-relevant validation of filename extensions is plausibly affected. Methods of NSString for conversion to a string may return a partial result. Because they call CStr::from_ptr on a pointer to the string buffer, the string is terminated at the first '\0' byte, which might not be the end of the string.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-15T04:16:20.000Z
CVE-2021-43628 
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the email parameter in hms-staff.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:17:09.000Z
CVE-2021-43629 
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in admin_home.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:18:32.000Z
CVE-2021-43630 
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via multiple parameters in add_patient.php. As a result, an authenticated malicious user can compromise the databases system and in some cases leverage this vulnerability to get remote code execution on the remote web server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:19:15.000Z
CVE-2021-43631 
Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointment_no parameter in payment.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-22T17:20:07.000Z
CVE-2021-43633 
Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-14T12:18:16.000Z
CVE-2021-43635 
A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T17:40:40.000Z
CVE-2021-43636 
Two Buffer Overflow vulnerabilities exists in T10 V2_Firmware V4.1.8cu.5207_B20210320 in the http_request_parse function when processing host data in the HTTP request process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-25T17:55:41.000Z
CVE-2021-43637 
Amazon WorkSpaces agent is affected by Buffer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T19:59:33.000Z
CVE-2021-43638 
Amazon Amazon WorkSpaces agent is affected by Integer Overflow. IOCTL Handler 0x22001B in the Amazon WorkSpaces agent below v1.0.1.1537 allow local attackers to execute arbitrary code in kernel mode or cause a denial of service (memory corruption and OS crash) via specially crafted I/O Request Packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T20:00:51.000Z
CVE-2021-43650 
WebRun 3.6.0.42 is vulnerable to SQL Injection via the P_0 parameter used to set the username during the login process.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-22T15:05:34.000Z
CVE-2021-43657 
A Stored Cross-site scripting (XSS) vulnerability via MAster.php in Sourcecodetester Simple Client Management System (SCMS) 1.0 allows remote attackers to inject arbitrary web script or HTML via the vulnerable input fields.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-22T00:00:00.000Z
CVE-2021-43659 
In halo 1.4.14, the function point of uploading the avatar, any file can be uploaded, such as uploading an HTML file, which will cause a stored XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-24T13:09:12.000Z
CVE-2021-43661 
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /home.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T23:19:19.000Z
CVE-2021-43662 
totolink EX300_v2, ver V4.0.3c.140_B20210429 and A720R ,ver V4.1.5cu.470_B20200911 have an issue which causes uncontrolled resource consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T23:26:03.000Z
CVE-2021-43663 
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T23:40:13.000Z
CVE-2021-43664 
totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process&nbsp;forceugpo.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:53:59.000Z
CVE-2021-43666 
A Denial of Service vulnerability exists in mbed TLS 3.0.0 and earlier in the mbedtls_pkcs12_derivation function when an input password's length is 0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-24T00:00:00.000Z
CVE-2021-43667 
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-18T15:05:14.000Z
CVE-2021-43668 
Go-Ethereum 1.10.9 nodes crash (denial of service) after receiving a serial of messages and cannot be recovered. They will crash with "runtime error: invalid memory address or nil pointer dereference" and arise a SEGV signal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-18T15:05:20.000Z
CVE-2021-43669 
A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-18T15:05:27.000Z
CVE-2021-43673 
dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user via exit(json_encode($return)).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T11:36:13.000Z
CVE-2021-43674 
ThinkUp 2.0-beta.10 is affected by a path manipulation vulnerability in Smarty.class.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T12:33:30.000Z
CVE-2021-43675 
Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-15T15:24:40.000Z
CVE-2021-43676 
matyhtf framework v3.0.5 is affected by a path manipulation vulnerability in Smarty.class.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-03T13:50:04.000Z
CVE-2021-43677 
Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-04T19:10:41.000Z
CVE-2021-43678 
Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-17T12:49:17.000Z
CVE-2021-43679 
ecshop v2.7.3 is affected by a SQL injection vulnerability in shopex\ecshop\upload\api\client\api.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T14:13:59.000Z
CVE-2021-43681 
SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and print the message $data['proxy_name'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T12:47:55.000Z
CVE-2021-43682 
thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER['HTTP_HOST'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T13:37:13.000Z
CVE-2021-43683 
pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will terminate the script and print the message which has $_REQUEST['hash'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T12:36:56.000Z
CVE-2021-43685 
libretime hv3.0.0-alpha.10 is affected by a path manipulation vulnerability in /blob/master/legacy/application/modules/rest/controllers/ShowImageController.php through the rename function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T15:11:16.000Z
CVE-2021-43686 
nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $_GET['t'].
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-02T12:17:33.000Z
CVE-2021-43687 
chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T15:49:46.000Z
CVE-2021-43689 
manage (last update Oct 24, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in Application/Home/Controller/GoodsController.class.php. The exit function will terminate the script and print a message which have values from $_POST.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T14:25:34.000Z
CVE-2021-43690 
YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. The exit function will terminate the script and print a message which have values from the socket_read.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-01T12:27:00.000Z
CVE-2021-43691 
tripexpress v1.1 is affected by a path manipulation vulnerability in file system/helpers/dompdf/load_font.php. The variable src is coming from $_SERVER["argv"] then there is a path manipulation vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T15:04:21.000Z
CVE-2021-43692 
youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T14:27:44.000Z
CVE-2021-43693 
vesta 0.9.8-24 is affected by a file inclusion vulnerability in file web/add/user/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T14:13:40.000Z
CVE-2021-43695 
issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST without sanitization, then there is a XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T13:34:03.000Z
CVE-2021-43696 
twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php, the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST then there is a XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T12:52:24.000Z
CVE-2021-43697 
Workerman-ThinkPHP-Redis (last update Mar 16, 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER')] then there is a XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T12:25:33.000Z
CVE-2021-43698 
phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php, the exit function will terminate the script and print the message to the user. The message will contain $_GET['query'] then there is a XSS vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-29T11:33:36.000Z
CVE-2021-43700 
An issue was discovered in ApiManager 1.1. there is sql injection vulnerability that can use in /index.php?act=api&tag=8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-24T12:58:28.000Z
CVE-2021-43701 
CSZ CMS 1.2.9 has a Time and Boolean-based Blind SQL Injection vulnerability in the endpoint /admin/export/getcsv/article_db, via the fieldS[] and orderby parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-29T15:31:16.000Z
CVE-2021-43702 
ASUS RT-A88U 3.0.0.4.386_45898 is vulnerable to Cross Site Scripting (XSS). The ASUS router admin panel does not sanitize the WiFI logs correctly, if an attacker was able to change the SSID of the router with a custom payload, they could achieve stored XSS on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-05T11:50:03.000Z
CVE-2021-43703 
An Incorrect Access Control vulnerability exists in zzcms less than or equal to 2019 via admin.php. After disabling JavaScript, you can directly access the administrator console.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-09T16:38:40.000Z
CVE-2021-43707 
Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T19:14:29.000Z
CVE-2021-43708 
The Labeling tool in Titus Classification Suite 18.8.1910.140 allows users to avoid the generation of a classification label by using Excel's safe mode.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-21T18:12:56.000Z
CVE-2021-43711 
The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for unauthenticated command execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-04T13:49:47.000Z
CVE-2021-43712 
Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T20:58:43.000Z
CVE-2021-43721 
Leanote 2.7.0 is vulnerable to Cross Site Scripting (XSS) in the markdown type note. This leads to remote code execution with payload : <video src=x onerror=(function(){require('child_process').exec('calc');})();>
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T13:37:04.000Z
CVE-2021-43722 
D-Link DIR-645 1.03 A1 is vulnerable to Buffer Overflow. The hnap_main function in the cgibin handler uses sprintf to format the soapaction header onto the stack and has no limit on the size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-31T20:28:00.000Z
CVE-2021-43724 
A Cross Site Scripting (XSS) vulnerability exits in Subrion CMS through 4.2.1 in the Create Page functionality of the admin Account via a SGV file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-23T18:31:30.000Z
CVE-2021-43725 
There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the data[performredirect] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-28T12:52:07.000Z
CVE-2021-43728 
Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized SSID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T14:51:49.000Z
CVE-2021-43729 
Pix-Link MiNi Router 28K.MiniRouter.20190211 was discovered to contain a stored cross-site scripting (XSS) vulnerability due to an unsanitized Security Key parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-20T14:51:08.000Z
CVE-2021-43734 
kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-15T13:21:39.000Z
CVE-2021-43735 
CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T15:17:33.000Z
CVE-2021-43736 
CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rule
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T15:21:25.000Z
CVE-2021-43737 
An issus was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can modify administrator account's password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T16:03:38.000Z
CVE-2021-43738 
An issue was discovered in xiaohuanxiong CMS 5.0.17. There is a CSRF vulnerability that can that can add the administrator account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T16:00:17.000Z
CVE-2021-43741 
CMSimple 5.4 is vulnerable to Directory Traversal. The vulnerability exists when a user changes the file name to malicious file on config.php leading to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-13T13:16:10.000Z