Archive

24 May 2021

Vulnerabilities first published on this day (UTC), newest first.

← April 2021 2021 / May /24 June 2021 →

All Critical High Medium Low Exploited only Public exploit

93 results · Feed

Unscored —

CVE-2021-24298 Scanner template

Simple Giveaways < 2.36.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The method and share GET parameters of the Giveaway pages were not sanitised, validated or escaped before being output back in the pages, thus leading to reflected XSS

Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests

May 24, 2021
Unscored —

CVE-2021-24300 Public exploit Scanner template EPSS 11%

PickPlugins Product Slider for WooCommerce < 1.13.22 - Reflected Cross-Site Scripting (XSS)

The slider import search feature of the PickPlugins Product Slider for WooCommerce WordPress plugin before 1.13.22 did not properly sanitised the keyword GET parameter, leading to reflected Cross-Site Scripting issue

PickPlugins PickPlugins Product Slider for WooCommerce Web / CMS

May 24, 2021
Unscored —

CVE-2021-24305

Target First Plugin 2.0 - Unauthenticated Stored XSS via Licence Key

The Target First WordPress Plugin v2.0, also previously known as Watcheezy, suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be s…

TargetFirst Target First Plugin Web / CMS

May 24, 2021
Unscored —

CVE-2021-24294

DSGVO All in one for WP < 4.0 - Unauthenticated Stored Cross-Site Scripting (XSS)

The dsgvoaio_write_log AJAX action of the DSGVO All in one for WP WordPress plugin before 4.0 did not sanitise or escape some POST parameter submitted before outputting them in the Log page in the administrator dashboard (wp-admin/admin.php?page=dsgvoaiofree-…

Michael Leithold DSGVO All in one for WP Web / CMS

May 24, 2021
Unscored —

CVE-2021-25938

In ArangoDB, versions v2.2.6.2 through v3.7.10 are vulnerable to Cross-Site Scripting (XSS), since there is no validati…

May 24, 2021
Critical 9.1

CVE-2021-33497

Path Traversal in Dutchcoders transfer.sh

Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.

github.com/dutchcoders/transfer.sh Go

May 24, 2021
Medium 6.1

CVE-2021-33496

Cross-site scripting in Dutchcoders transfer.sh

Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.

github.com/dutchcoders/transfer.sh Go

May 24, 2021
Unscored —

CVE-2021-20726

Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privi…

Overwolf The Installer of Overwolf

May 24, 2021
Unscored —

CVE-2021-20725

Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows…

PHP Factory [Calendar01] free edition

May 24, 2021
Unscored —

CVE-2021-20723

Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed …

PHP Factory [MailForm01] free edition

May 24, 2021
Unscored —

CVE-2021-20724

Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a …

PHP Factory [Telop01] free edition

May 24, 2021
High 7.8

CVE-2021-20722

Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Do…

FUJITSU LIMITED and PFU The installers of ScanSnap Manager and the Software Download Installer

May 24, 2021
Unscored —

CVE-2021-20713

Privilege escalation vulnerability in QND Advance/Premium/Standard Ver.11.0.4i and earlier allows an attacker who can l…

QualitySoft QND Advance/Premium/Standard

May 24, 2021