rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-41646 
Remote Code Execution (RCE) vulnerability exists in Sourcecodester Online Reviewer System 1.0 by uploading a maliciously crafted PHP file that bypasses the image upload filters..
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T17:02:57.000Z
CVE-2021-41647 
An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an administrative user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T14:32:43.000Z
CVE-2021-41648 
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /action.php prId parameter. Using a post request does not sanitize the user input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T13:53:37.000Z
CVE-2021-41649 
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-01T13:51:05.000Z
CVE-2021-41651 
A blind SQL injection vulnerability exists in the Raymart DG / Ahmed Helal Hotel-mgmt-system. A malicious attacker can retrieve sensitive database information and interact with the database using the vulnerable cid parameter in process_update_profile.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-04T18:01:24.000Z
CVE-2021-41652 
Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-01T22:38:47.000Z
CVE-2021-41653 
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-13T14:18:52.000Z
CVE-2021-41654 
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T11:22:05.000Z
CVE-2021-41657 
SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-07T21:02:53.000Z
CVE-2021-41658 
Cross Site Scripting (XSS) in Sourcecodester Student Quarterly Grading System by oretnom23, allows attackers to execute arbitrary code via the fullname and username parameters to the users page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-24T16:03:34.000Z
CVE-2021-41659 
SQL injection vulnerability in Sourcecodester Banking System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username or password field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-24T17:47:42.000Z
CVE-2021-41660 
SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password fields to login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-01-24T17:52:28.000Z
CVE-2021-41661 
Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-13T22:30:41.000Z
CVE-2021-41662 
The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file upload, which is caused by improper file handling in the editImg function. This vulnerability leads to remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-13T22:45:26.000Z
CVE-2021-41663 
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-13T17:10:56.000Z
CVE-2021-41672 
PEEL Shopping CMS 9.4.0 is vulnerable to authenticated SQL injection in utilisateurs.php. A user that belongs to the administrator group can inject a malicious SQL query in order to affect the execution logic of the application and retrive information from the database.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-15T15:13:44.000Z
CVE-2021-41674 
An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/login.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T15:30:46.000Z
CVE-2021-41675 
A Remote Code Execution (RCE) vulnerabilty exists in Sourcecodester E-Negosyo System 1.0 in /admin/produts/controller.php via the doInsert function, which validates images with getImageSizei. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T15:38:24.000Z
CVE-2021-41676 
An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T15:54:18.000Z
CVE-2021-41677 
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T12:59:16.000Z
CVE-2021-41678 
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T13:07:34.000Z
CVE-2021-41679 
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-30T13:17:14.000Z
CVE-2021-41682 
There is a heap-use-after-free at ecma-helpers-string.c:1940 in ecma_compare_ecma_non_direct_strings in JerryScript 2.4.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-20T13:14:05.000Z
CVE-2021-41683 
There is a stack-overflow at ecma-helpers.c:326 in ecma_get_lex_env_type in JerryScript 2.4.0
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-20T13:33:04.000Z
CVE-2021-41687 
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-28T09:46:23.000Z
CVE-2021-41688 
DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-28T09:44:06.000Z
CVE-2021-41689 
DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-28T09:38:17.000Z
CVE-2021-41690 
DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-28T09:41:00.000Z
CVE-2021-41691 
A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-06-24T00:00:00.000Z
CVE-2021-41694 
An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-09T15:22:51.000Z
CVE-2021-41695 
An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. .
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-09T15:29:14.000Z
CVE-2021-41696 
An authentication bypass (account takeover) vulnerability exists in Premiumdatingscript 4.2.7.7 due to a weak password reset mechanism in requests\user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-09T15:33:49.000Z
CVE-2021-41697 
A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/sources/instagram.php script.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-09T15:35:25.000Z
CVE-2021-41714 
In Tipask < 3.5.9, path parameters entered by the user are not validated when downloading attachments, a registered user can download arbitrary files on the Tipask server such as .env, /etc/passwd, laravel.log, causing infomation leakage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N
version: 3.1
Published: 2022-05-23T15:34:34.000Z
CVE-2021-41715 
libsixel 1.10.0 is vulnerable to Use after free in libsixel/src/dither.c:379.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-08T14:55:27.000Z
CVE-2021-41716 
Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-12-07T18:37:35.000Z
CVE-2021-41719 
Maharashtra State Electricity Distribution Company Limited Mahavitran IOS Application 16.1 application till version 16.1 communicates using the GET method to process requests that contain sensitive information such as user account name and password, which can expose that information through the browser's history, referrers, web logs, and other sources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2025-03-04T00:00:00.000Z
CVE-2021-41728 
Cross Site Scripting (XSS) vulnerability exists in Sourcecodester News247 CMS 1.0 via the search function in articles.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-28T14:37:07.000Z
CVE-2021-41729 
BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-30T10:43:10.000Z
CVE-2021-41731 
Cross Site Scripting (XSS vulnerability exists in )Sourcecodester News247 News Magazine (CMS) PHP 5.6 or higher and MySQL 5.7 or higher via the blog category name field
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T16:18:09.000Z
CVE-2021-41732 
An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-29T18:34:01.000Z
CVE-2021-41733 
Oppia 3.1.4 does not verify that certain URLs are valid before navigating to them.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T14:10:44.000Z
CVE-2021-41736 
Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-03-22T17:23:04.000Z
CVE-2021-41737 
In Faust 2.23.1, an input file with the lines "// r visualisation tCst" and "//process = +: L: abM-^Q;" and "process = route(3333333333333333333,2,1,2,3,1) : *;" leads to stack consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-11-10T00:00:00.000Z
CVE-2021-41738 
ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-11T13:26:10.000Z
CVE-2021-41739 
A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-05T10:41:00.000Z
CVE-2021-41744 
All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T11:40:15.000Z
CVE-2021-41745 
ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T11:56:28.000Z
CVE-2021-41746 
SQL Injection vulnerability exists in all versions of Yonyou TurboCRM.via the orgcode parameter in changepswd.php. Attackers can use the vulnerabilities to obtain sensitive database information.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-29T17:22:28.000Z
CVE-2021-41747 
Cross-Site Scripting (XSS) vulnerability exists in Csdn APP 4.10.0, which can be exploited by attackers to obtain sensitive information such as user cookies.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-10-22T11:51:35.000Z
CVE-2021-41749 
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-12T11:00:13.000Z
CVE-2021-41750 
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-12T11:29:00.000Z
CVE-2021-41751 
Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T15:37:13.000Z
CVE-2021-41752 
Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt() function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-05T15:37:54.000Z
CVE-2021-41753 
A denial-of-service attack in WPA2, and WPA3-SAE authentication methods in D-Link DIR-X1560, v1.04B04, and DIR-X6060, v1.11B04 allows a remote unauthenticated attacker to disconnect a wireless client via sending specific spoofed SAE authentication frames.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-27T16:22:43.000Z
CVE-2021-41754 
dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T20:52:29.000Z
CVE-2021-41755 
dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T21:12:36.000Z
CVE-2021-41756 
dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-10T21:17:07.000Z
CVE-2021-41764 
A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-09-29T19:02:00.000Z
CVE-2021-41765 
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-15T15:52:25.000Z
CVE-2021-41766 Insecure Java Deserialization in Apache Karaf
Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the default JMX implementation is hardened against unauthenticated deserialization attacks, the implementation used by Apache Karaf is not protected against this kind of attack. The impact of Java deserialization vulnerabilities strongly depends on the classes that are available within the targets class path. Generally speaking, deserialization of untrusted data does always represent a high security risk and should be prevented. The risk is low as, by default, Karaf uses a limited set of classes in the JMX server class path. It depends of system scoped classes (e.g. jar in the lib folder).
Problem types: description: Insecure Java Deserialization
Affected products: vendor: Apache Software Foundation
product: Apache Karaf
Credits: lang: en
value: This issue was reported by Daniel Heyne, Konstantin Samuel and Tobias Neitzel.
Published: 2022-01-26T11:10:11.000Z
CVE-2021-41767 Private tunnel identifier may be included in the non-private details of active connections
Apache Guacamole 1.3.0 and older may incorrectly include a private tunnel identifier in the non-private details of some REST responses. This may allow an authenticated user who already has permission to access a particular connection to read from or interact with another user's active use of that same connection.
Problem types: cwe_id: CWE-200
description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Apache Software Foundation
product: Apache Guacamole
Credits: lang: en
value: We would like to thank Damian Velardo (Australia and New Zealand Banking Group) for reporting this issue.
Published: 2022-01-11T22:10:11.000Z
CVE-2021-41770 
Ping Identity PingFederate before 10.3.1 mishandles pre-parsing validation, leading to an XXE attack that can achieve XML file disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Credits: lang: en
value: Ping Identity credits An Trinh of Calif. for their responsible disclosure.
Published: 2021-10-07T06:24:36.000Z
CVE-2021-41771 
ImportedSymbols in debug/macho (for Open or OpenFat) in Go before 1.16.10 and 1.17.x before 1.17.3 Accesses a Memory Location After the End of a Buffer, aka an out-of-bounds slice situation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T00:00:00.000Z
CVE-2021-41772 
Go before 1.16.10 and 1.17.x before 1.17.3 allows an archive/zip Reader.Open panic via a crafted ZIP archive containing an invalid name or an empty filename field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2021-11-08T00:00:00.000Z
CVE-2021-41773 Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49
A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
Credits: lang: en
value: This issue was reported by Ash Daulton along with the cPanel Security Team
Published: 2021-10-05T08:40:12.000Z
CVE-2021-41780 
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-29T04:54:27.000Z