CVEs

413,635 total · page 4975 of 8,273

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2021-38109	NOS Microsystems DrawStandard 2020	Med	0.36	5.5	0.02	Oct 2, 2021	Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue…
CVE-2021-38108	NOS Microsystems Wordperfect 2020	Med	0.36	5.5	0.02	Oct 2, 2021	Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user.…
CVE-2021-38107	NOS Microsystems Corel DrawStandard	Med	0.36	5.5	0.02	Oct 2, 2021	CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-41847	3xLogic Infinias Access Control	Hig	0.57	8.8	0.02	Oct 1, 2021	An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and…
CVE-2021-38110	NOS Microsystems Wordperfect 2020	Hig	0.51	7.8	0.02	Oct 1, 2021	Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user.…
CVE-2021-38106	NOS Microsystems Presentations 2020	Med	0.36	5.5	0.02	Oct 1, 2021	UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38105	NOS Microsystems Presentations 2020	Med	0.36	5.5	0.02	Oct 1, 2021	IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38102	NOS Microsystems Presentations 2020	Med	0.36	5.5	0.02	Oct 1, 2021	IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38101	NOS Microsystems PhotoPaint Standard	Hig	0.51	7.8	0.02	Oct 1, 2021	CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user.…
CVE-2021-38100	NOS Microsystems PhotoPaint Standard 2020	Hig	0.51	7.8	0.02	Oct 1, 2021	Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this…
CVE-2021-38098	NOS Microsystems PDF Fusion	Hig	0.51	7.8	0.02	Oct 1, 2021	Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2021-36309	Dell Enterprise Sonic OS	Hig	0.46	7.1	0.01	Oct 1, 2021	Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks.
CVE-2021-36298	Dell InsightIQ	Hig	0.53	8.1	0.01	Oct 1, 2021	Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker…
CVE-2020-21228	Jizhicms Jizhicms	Med	0.40	6.1	0.01	Oct 1, 2021	JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
CVE-2021-41845	Thycotic Secret Server	Med	0.42	6.5	0.01	Oct 1, 2021	A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. The only affected versions are 10.9.000032 through 11.0.000006.
CVE-2021-38104	NOS Microsystems Presentations 2020	Med	0.36	5.5	0.02	Oct 1, 2021	IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38103	NOS Microsystems Presentations 2020	Hig	0.51	7.8	0.02	Oct 1, 2021	IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation…
CVE-2021-38099	NOS Microsystems PhotoPaint Standard 2020	Hig	0.51	7.8	0.02	Oct 1, 2021	CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user.…
CVE-2021-38096	NOS Microsystems PDF Fusion	Hig	0.51	7.8	0.03	Oct 1, 2021	Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this…
CVE-2020-21014	Emlog Emlog	Med	0.42	6.5	0.01	Oct 1, 2021	emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
CVE-2020-21013	Emlog Emlog	Hig	0.47	7.2	0.01	Oct 1, 2021	emlog v6.0.0 contains a SQL injection via /admin/comment.php.
CVE-2020-21012	Sourcecodester Hotel and Lodge Management System	Cri	0.64	9.8	0.04	Oct 1, 2021	Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVE-2021-38097	NOS Microsystems PDF Fusion	Hig	0.51	7.8	0.03	Oct 1, 2021	Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires…
CVE-2021-41467	Justwriting Project Justwriting	Med	0.40	6.1	0.04	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
CVE-2021-41465	Concrete5 Concrete5	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVE-2021-41464	Concrete5 Concrete5	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVE-2021-41463	Concrete5 Concrete5	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter.
CVE-2021-41462	Concrete5 Concrete5	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter.
CVE-2021-41461	Concrete5 Concrete5	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVE-2021-40975	Ecommerce-CodeIgniter-Bootstrap Ecommerce-CodeIgniter-Bootstrap	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Bootstrap 3.3.7) allows remote attackers to inject arbitrary web script or HTML via the search_title parameter.
CVE-2021-40973	spotweb spotweb	Med	0.40	6.1	0.02	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
CVE-2021-40972	spotweb spotweb	Med	0.40	6.1	0.02	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.
CVE-2021-40971	spotweb spotweb	Med	0.40	6.1	0.02	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.
CVE-2021-40970	spotweb spotweb	Med	0.40	6.1	0.02	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.
CVE-2021-40969	spotweb spotweb	Med	0.40	6.1	0.02	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.
CVE-2021-40968	spotweb spotweb	Med	0.40	6.1	0.02	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.
CVE-2021-40928	FlexTV FlexTV	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF parameter.
CVE-2021-40927	citelao Spotify-for-Alfred	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVE-2021-40926	Getid3 Getid3	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
CVE-2021-40925	Faveohelpdesk Faveo	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter.
CVE-2021-40924	pixeline Bugs	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the first_name parameter.
CVE-2021-40923	pixeline Bugs	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVE-2021-40922	pixeline Bugs	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the last_name parameter.
CVE-2021-40921	Detector Detector	Med	0.40	6.1	0.01	Oct 1, 2021	Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitrary web script or HTML via the cid parameter.
CVE-2021-41647	Kaushik Jadhav Online Food Ordering Web App	Cri	0.59	9.1	0.02	Oct 1, 2021	An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an…
CVE-2021-3825	LiderAhenk Lider module	Cri	0.63	9.6	0.02	Oct 1, 2021	On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.
CVE-2021-29110	Esri Portal For Arcgis	Med	0.35	5.4	0.01	Oct 1, 2021	Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
CVE-2021-29109	Esri Portal For Arcgis	Med	0.40	6.1	0.01	Oct 1, 2021	A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVE-2021-29108	Esri Portal For Arcgis	Hig	0.57	8.8	0.01	Oct 1, 2021	There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature…
CVE-2021-41649	PuneethReddyHC Online Shopping System Advanced	Cri	0.68	9.8	0.52	Oct 1, 2021	An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.

CVE-2021-38109MedOct 2, 2021
NOS Microsystems
DrawStandard 2020
risk 0.36cvss 5.5epss 0.02
Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation of this issue…
CVE-2021-38108MedOct 2, 2021
NOS Microsystems
Wordperfect 2020
risk 0.36cvss 5.5epss 0.02
Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user.…
CVE-2021-38107MedOct 2, 2021
NOS Microsystems
Corel DrawStandard
risk 0.36cvss 5.5epss 0.02
CdrCore.dll in Corel DrawStandard 2020 22.0.0.474 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-41847HigOct 1, 2021
3xLogic
Infinias Access Control
risk 0.57cvss 8.8epss 0.02
An issue was discovered in 3xLogic Infinias Access Control through 6.7.10708.0, affecting physical security. Users with login credentials assigned to a specific zone can send modified HTTP GET and POST requests, allowing them to view user data such as personal information and…
CVE-2021-38110HigOct 1, 2021
NOS Microsystems
Wordperfect 2020
risk 0.51cvss 7.8epss 0.02
Word97Import200.dll in Corel WordPerfect 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user.…
CVE-2021-38106MedOct 1, 2021
NOS Microsystems
Presentations 2020
risk 0.36cvss 5.5epss 0.02
UAX200.dll in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38105MedOct 1, 2021
NOS Microsystems
Presentations 2020
risk 0.36cvss 5.5epss 0.02
IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38102MedOct 1, 2021
NOS Microsystems
Presentations 2020
risk 0.36cvss 5.5epss 0.02
IPPP82.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38101HigOct 1, 2021
NOS Microsystems
PhotoPaint Standard
risk 0.51cvss 7.8epss 0.02
CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user.…
CVE-2021-38100HigOct 1, 2021
NOS Microsystems
PhotoPaint Standard 2020
risk 0.51cvss 7.8epss 0.02
Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this…
CVE-2021-38098HigOct 1, 2021
NOS Microsystems
PDF Fusion
risk 0.51cvss 7.8epss 0.02
Corel PDF Fusion 2.6.2.0 is affected by a Heap Corruption vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2021-36309HigOct 1, 2021
Dell
Enterprise Sonic OS
risk 0.46cvss 7.1epss 0.01
Dell Enterprise SONiC OS, versions 3.3.0 and earlier, contains a sensitive information disclosure vulnerability. An authenticated malicious user with access to the system may use the TACACS\Radius credentials stored to read sensitive information and use it in further attacks.
CVE-2021-36298HigOct 1, 2021
Dell
InsightIQ
risk 0.53cvss 8.1epss 0.01
Dell EMC InsightIQ, versions prior to 4.1.4, contain risky cryptographic algorithms in the SSH component. A remote unauthenticated attacker could potentially exploit this vulnerability leading to authentication bypass and remote takeover of the InsightIQ. This allows an attacker…
CVE-2020-21228MedOct 1, 2021
Jizhicms
Jizhicms
risk 0.40cvss 6.1epss 0.01
JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie.
CVE-2021-41845MedOct 1, 2021
Thycotic
Secret Server
risk 0.42cvss 6.5epss 0.01
A SQL injection issue was discovered in ThycoticCentrify Secret Server before 11.0.000007. The only affected versions are 10.9.000032 through 11.0.000006.
CVE-2021-38104MedOct 1, 2021
NOS Microsystems
Presentations 2020
risk 0.36cvss 5.5epss 0.02
IPPP72.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Read vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to access unauthorized system memory in the context of the current user. Exploitation…
CVE-2021-38103HigOct 1, 2021
NOS Microsystems
Presentations 2020
risk 0.51cvss 7.8epss 0.02
IBJPG2.FLT in Corel Presentations 2020 20.0.0.200 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation…
CVE-2021-38099HigOct 1, 2021
NOS Microsystems
PhotoPaint Standard 2020
risk 0.51cvss 7.8epss 0.02
CDRRip.dll in Corel PhotoPaint Standard 2020 22.0.0.474 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user.…
CVE-2021-38096HigOct 1, 2021
NOS Microsystems
PDF Fusion
risk 0.51cvss 7.8epss 0.03
Coreip.dll in Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this…
CVE-2020-21014MedOct 1, 2021
Emlog
Emlog
risk 0.42cvss 6.5epss 0.01
emlog v6.0.0 contains an arbitrary file deletion vulnerability in admin/plugin.php.
CVE-2020-21013HigOct 1, 2021
Emlog
Emlog
risk 0.47cvss 7.2epss 0.01
emlog v6.0.0 contains a SQL injection via /admin/comment.php.
CVE-2020-21012CriOct 1, 2021
Sourcecodester
Hotel and Lodge Management System
risk 0.64cvss 9.8epss 0.04
Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVE-2021-38097HigOct 1, 2021
NOS Microsystems
PDF Fusion
risk 0.51cvss 7.8epss 0.03
Corel PDF Fusion 2.6.2.0 is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires…
CVE-2021-41467MedOct 1, 2021
Justwriting Project
Justwriting
risk 0.40cvss 6.1epss 0.04
Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
CVE-2021-41465MedOct 1, 2021
Concrete5
Concrete5
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVE-2021-41464MedOct 1, 2021
Concrete5
Concrete5
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVE-2021-41463MedOct 1, 2021
Concrete5
Concrete5
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter.
CVE-2021-41462MedOct 1, 2021
Concrete5
Concrete5
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter.
CVE-2021-41461MedOct 1, 2021
Concrete5
Concrete5
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVE-2021-40975MedOct 1, 2021
Ecommerce-CodeIgniter-Bootstrap
Ecommerce-CodeIgniter-Bootstrap
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in application/modules/admin/views/ecommerce/products.php in Ecommerce-CodeIgniter-Bootstrap (Codeigniter 3.1.11, Bootstrap 3.3.7) allows remote attackers to inject arbitrary web script or HTML via the search_title parameter.
CVE-2021-40973MedOct 1, 2021
spotweb
spotweb
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter.
CVE-2021-40972MedOct 1, 2021
spotweb
spotweb
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter.
CVE-2021-40971MedOct 1, 2021
spotweb
spotweb
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter.
CVE-2021-40970MedOct 1, 2021
spotweb
spotweb
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter.
CVE-2021-40969MedOct 1, 2021
spotweb
spotweb
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter.
CVE-2021-40968MedOct 1, 2021
spotweb
spotweb
risk 0.40cvss 6.1epss 0.02
Cross-site scripting (XSS) vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword2 parameter.
CVE-2021-40928MedOct 1, 2021
FlexTV
FlexTV
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in index.php in FlexTV beta development version allows remote attackers to inject arbitrary web script or HTML via the PHP_SELF parameter.
CVE-2021-40927MedOct 1, 2021
citelao
Spotify-for-Alfred
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in callback.php in Spotify-for-Alfred 0.13.9 and below allows remote attackers to inject arbitrary web script or HTML via the error parameter.
CVE-2021-40926MedOct 1, 2021
Getid3
Getid3
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
CVE-2021-40925MedOct 1, 2021
Faveohelpdesk
Faveo
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $_SERVER["PHP_SELF"] parameter.
CVE-2021-40924MedOct 1, 2021
pixeline
Bugs
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the first_name parameter.
CVE-2021-40923MedOct 1, 2021
pixeline
Bugs
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the email parameter.
CVE-2021-40922MedOct 1, 2021
pixeline
Bugs
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in install/index.php in bugs 1.8 and below version allows remote attackers to inject arbitrary web script or HTML via the last_name parameter.
CVE-2021-40921MedOct 1, 2021
Detector
Detector
risk 0.40cvss 6.1epss 0.01
Cross-site scripting (XSS) vulnerability in _contactform.inc.php in Detector 0.8.5 and below version allows remote attackers to inject arbitrary web script or HTML via the cid parameter.
CVE-2021-41647CriOct 1, 2021
Kaushik Jadhav
Online Food Ordering Web App
risk 0.59cvss 9.1epss 0.02
An un-authenticated error-based and time-based blind SQL injection vulnerability exists in Kaushik Jadhav Online Food Ordering Web App 1.0. An attacker can exploit the vulnerable "username" parameter in login.php and retrieve sensitive database information, as well as add an…
CVE-2021-3825CriOct 1, 2021
LiderAhenk
Lider module
risk 0.63cvss 9.6epss 0.02
On 2.1.15 version and below of Lider module in LiderAhenk software is leaking it's configurations via an unsecured API. An attacker with an access to the configurations API could get valid LDAP credentials.
CVE-2021-29110MedOct 1, 2021
Esri
Portal For Arcgis
risk 0.35cvss 5.4epss 0.01
Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.
CVE-2021-29109MedOct 1, 2021
Esri
Portal For Arcgis
risk 0.40cvss 6.1epss 0.01
A reflected XSS vulnerability in Esri Portal for ArcGIS version 10.9 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
CVE-2021-29108HigOct 1, 2021
Esri
Portal For Arcgis
risk 0.57cvss 8.8epss 0.01
There is an privilege escalation vulnerability in organization-specific logins in Esri Portal for ArcGIS versions 10.9 and below that may allow a remote, authenticated attacker who is able to intercept and modify a SAML assertion to impersonate another account (XML Signature…
CVE-2021-41649CriOct 1, 2021
PuneethReddyHC
Online Shopping System Advanced
risk 0.68cvss 9.8epss 0.52
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.