rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-45997 
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetPortMapping. This vulnerability allows attackers to cause a Denial of Service (DoS) via the portMappingServer, portMappingProtocol, portMappingWan, porMappingtInternal, and portMappingExternal parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:39.000Z
CVE-2021-45998 
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-04T01:33:38.000Z
CVE-2021-46005 
Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T17:35:27.000Z
CVE-2021-46006 
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:43:13.000Z
CVE-2021-46007 
totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not adequately filter special symbols. This can lead to command injection attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:12:22.000Z
CVE-2021-46008 
In totolink a3100r V5.9c.4577, the hard-coded telnet password can be discovered from official released firmware. An attacker, who has connected to the Wi-Fi, can easily telnet into the target with root shell if the telnet is function turned on.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:20:45.000Z
CVE-2021-46009 
In Totolink A3100R V5.9c.4577, multiple pages can be read by curl or Burp Suite without authentication. Additionally, admin configurations can be set without cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:18:31.000Z
CVE-2021-46010 
Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSION_ID is predictable. An attacker can hijack a valid session and conduct further malicious operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-30T22:09:21.000Z
CVE-2021-46013 
An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-18T17:57:35.000Z
CVE-2021-46019 
An untrusted pointer dereference in rec_db_destroy() at rec-db.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T00:00:00.000Z
CVE-2021-46020 
An untrusted pointer dereference in mrb_vm_exec() of mruby v3.0.0 can lead to a segmentation fault or application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T20:01:27.000Z
CVE-2021-46021 
An Use-After-Free vulnerability in rec_record_destroy() at rec-record.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T20:02:06.000Z
CVE-2021-46022 
An Use-After-Free vulnerability in rec_mset_elem_destroy() at rec-mset.c of GNU Recutils v1.8.90 can lead to a segmentation fault or application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-14T00:00:00.000Z
CVE-2021-46023 
An Untrusted Pointer Dereference was discovered in function mrb_vm_exec in mruby before 3.1.0-rc. The vulnerability causes a segmentation fault and application crash.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-14T00:00:00.000Z
CVE-2021-46024 
Projectworlds online-shopping-webvsite-in-php 1.0 suffers from a SQL Injection vulnerability via the "id" parameter in cart_add.php, No login is required.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-23T16:18:17.000Z
CVE-2021-46025 
A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T22:54:40.000Z
CVE-2021-46026 
mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting (XSS) via the add blog tag function in the blog tag in the background blog management.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T23:04:40.000Z
CVE-2021-46027 
mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T23:01:29.000Z
CVE-2021-46028 
In mblog <= 3.5.0 there is a CSRF vulnerability in the background article management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, the article will be deleted.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T23:07:46.000Z
CVE-2021-46030 
There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T14:51:19.000Z
CVE-2021-46033 
In ForestBlog, as of 2021-12-28, File upload can bypass verification.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:01:17.000Z
CVE-2021-46034 
A problem was found in ForestBlog, as of 2021-12-29, there is a XSS vulnerability that can be injected through the nickname input box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:04:21.000Z
CVE-2021-46036 
An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T18:32:25.000Z
CVE-2021-46037 
MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T18:32:26.000Z
CVE-2021-46038 
A Pointer Dereference vulnerability exists in GPAC 1.0.1 in unlink_chunk.isra, which causes a Denial of Service (context-dependent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-05T00:00:00.000Z
CVE-2021-46039 
A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the shift_chunk_offsets.part function, which causes a Denial of Service (context-dependent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T00:00:00.000Z
CVE-2021-46040 
A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1 via the finplace_shift_moov_meta_offsets function, which causes a Denial of Servie (context-dependent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T00:00:00.000Z
CVE-2021-46041 
A Segmentation Fault Vulnerability exists in GPAC 1.0.1 via the co64_box_new function, which causes a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T00:00:00.000Z
CVE-2021-46042 
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the _fseeko function, which causes a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T00:00:00.000Z
CVE-2021-46043 
A Pointer Dereference Vulnerability exits in GPAC 1.0.1 in the gf_list_count function, which causes a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T00:00:00.000Z
CVE-2021-46044 
A Pointer Dereference Vulnerabilty exists in GPAC 1.0.1via ShiftMetaOffset.isra, which causes a Denial of Service (context-dependent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T00:00:00.000Z
CVE-2021-46045 
GPAC 1.0.1 is affected by: Abort failed. The impact is: cause a denial of service (context-dependent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2021-46046 
A Pointer Derefernce Vulnerbility exists GPAC 1.0.1 the gf_isom_box_size function, which could cause a Denial of Service (context-dependent).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2021-46047 
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_hinter_finalize function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2021-46048 
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::readFunctions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T22:04:17.000Z
CVE-2021-46049 
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the gf_fileio_check function, which could cause a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2021-46050 
A Stack Overflow vulnerability exists in Binaryen 103 via the printf_common function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T22:10:09.000Z
CVE-2021-46051 
A Pointer Dereference Vulnerability exists in GPAC 1.0.1 via the Media_IsSelfContained function, which could cause a Denial of Service. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T00:00:00.000Z
CVE-2021-46052 
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::Tuple::validate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T22:15:38.000Z
CVE-2021-46053 
A Denial of Service vulnerability exists in Binaryen 103. The program terminates with signal SIGKILL.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T22:18:39.000Z
CVE-2021-46054 
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T22:22:31.000Z
CVE-2021-46055 
A Denial of Service vulnerability exists in Binaryen 104 due to an assertion abort in wasm::WasmBinaryBuilder::visitRethrow(wasm::Rethrow*).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-07T22:25:13.000Z
CVE-2021-46061 
An SQL Injection vulnerability exists in Sourcecodester Computer and Mobile Repair Shop Management system (RSMS) 1.0 via the code parameter in /rsms/ node app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-20T19:18:31.000Z
CVE-2021-46062 
MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T19:36:41.000Z
CVE-2021-46063 
MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T19:36:42.000Z
CVE-2021-46064 
IrfanView 4.59 is vulnerable to buffer overflow via the function at address 0x413c70 (in 32bit version of the binary). The vulnerability triggers when the user opens malicious .tiff image.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-23T17:05:38.000Z
CVE-2021-46065 
A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-27T15:29:46.000Z
CVE-2021-46067 
In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:46:18.000Z
CVE-2021-46068 
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:46:53.000Z
CVE-2021-46069 
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:30:49.000Z
CVE-2021-46070 
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:29:47.000Z
CVE-2021-46071 
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:27:36.000Z
CVE-2021-46072 
A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:26:29.000Z
CVE-2021-46073 
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:25:03.000Z
CVE-2021-46074 
A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in login panel.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:23:10.000Z
CVE-2021-46075 
A Privilege Escalation vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. Staff account users can access the admin resources and perform CRUD Operations.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:02:19.000Z
CVE-2021-46076 
Sourcecodester Vehicle Service Management System 1.0 is vulnerable to File upload. An attacker can upload a malicious php file in multiple endpoints it leading to Code Execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T14:53:16.000Z
CVE-2021-46078 
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to a Stored Cross-Site Scripting vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:57:10.000Z
CVE-2021-46079 
An Unrestricted File Upload vulnerability exists in Sourcecodester Vehicle Service Management System 1.0. A remote attacker can upload malicious files leading to Html Injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T15:59:57.000Z
CVE-2021-46080 
A Cross Site Request Forgery (CSRF) vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-06T14:47:43.000Z
CVE-2021-46082 
Moxa TN-5900 v3.1 series routers, MGate 5109 v2.2 series protocol gateways, and MGate 5101-PBM-MN v2.1 series protocol gateways were discovered to contain a memory leak which allows attackers to cause a Denial of Service (DoS) via crafted packets.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T19:54:13.000Z
CVE-2021-46083 
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via the input box of the statistical code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:48:41.000Z
CVE-2021-46084 
uscat, as of 2021-12-28, is vulnerable to Cross Site Scripting (XSS) via "close registration information" input box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:46:02.000Z
CVE-2021-46085 
OneBlog <= 2.2.8 is vulnerable to Insecure Permissions. Low level administrators can delete high-level administrators beyond their authority.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:52:24.000Z
CVE-2021-46086 
xzs-mysql >= t3.4.0 is vulnerable to Insecure Permissions. The front end of this open source system is an online examination system. There is an unsafe vulnerability in the functional method of submitting examination papers. An attacker can use burpuite to modify parameters in the packet to destroy real data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:42:23.000Z
CVE-2021-46087 
In jfinal_cms >= 5.1 0, there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form, any user with background permission can affect the system security by entering malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T15:56:49.000Z
CVE-2021-46088 
Zabbix 4.0 LTS, 4.2, 4.4, and 5.0 LTS is vulnerable to Remote Code Execution (RCE). Any user with the "Zabbix Admin" role is able to run custom shell script on the application server in the context of the application user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-27T15:43:42.000Z
CVE-2021-46089 
In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T14:14:17.000Z
CVE-2021-46093 
eliteCMS v1.0 is vulnerable to Insecure Permissions via manage_uploads.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-01T18:36:51.000Z
CVE-2021-46097 
Dolphinphp v1.5.0 contains a remote code execution vulnerability in /application/common.php#action_log
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-27T17:21:43.000Z
CVE-2021-46101 
In Git for windows through 2.34.1 when using git pull to update the local warehouse, git.cmd can be run directly.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-31T12:35:37.000Z
CVE-2021-46102 
From version 0.2.14 to 0.2.16 for Solana rBPF, function "relocate" in the file src/elf.rs has an integer overflow bug because the sym.st_value is read directly from ELF file without checking. If the sym.st_value is rather large, an integer overflow is triggered while calculating the variable "addr" via "addr = (sym.st_value + refd_pa) as u64";
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-27T17:44:59.000Z
CVE-2021-46104 
An issue was discovered in webp_server_go 0.4.0. There is a directory traversal vulnerability that can read arbitrary file information on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-19T12:26:31.000Z
CVE-2021-46107 
Ligeo Archives Ligeo Basics as of 02_01-2022 is vulnerable to Server Side Request Forgery (SSRF) which allows an attacker to read any documents via the download features.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-17T20:33:09.000Z
CVE-2021-46108 
D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T03:58:41.000Z
CVE-2021-46109 
Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-03T14:34:16.000Z
CVE-2021-46110 
Online Shopping Portal v3.1 was discovered to contain multiple time-based SQL injection vulnerabilities via the email and contactno parameters.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-02-18T20:10:04.000Z
CVE-2021-46113 
In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-25T12:56:52.000Z
CVE-2021-46114 
jpress v 4.2.0 is vulnerable to RCE via io.jpress.module.product.ProductNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T18:50:02.000Z
CVE-2021-46115 
jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T16:31:28.000Z
CVE-2021-46116 
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T16:23:43.000Z
CVE-2021-46117 
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.page.PageNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T15:15:27.000Z
CVE-2021-46118 
jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-26T16:03:26.000Z