Archive
July 2021
Vulnerabilities first published in this month (UTC), newest first.
1,584 results · Feed
-
Unscored —
Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an stack exhaustion vulnerability in the /nova/bin/net process. …
-
Unscored —
Mikrotik RouterOs 6.44.5 (long-term tree) suffers from a memory corruption vulnerability in the /nova/bin/console proce…
-
Unscored —
Mikrotik RouterOs 6.44.5 (long-term tree) suffers from an assertion failure vulnerability in the /nova/bin/console proc…
-
Medium 4.3
An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details
-
Unscored —
app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.
-
Medium 6.4
WP Upload Restriction <= 2.2.3 - Authenticated Stored Cross-Site Scripting
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
-
Medium 4.3
WP Upload Restriction <= 2.2.3 - Missing Access Control in getSelectedMimeTypesByRole function
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
-
Medium 4.3
WP Upload Restriction <= 2.2.3 - Missing Access Control in deleteCustomType function
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
-
Critical 9.8CVE-2021-34624 Scanner template
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in File Uploader Component
A vulnerability in the file uploader component found in the ~/src/Classes/FileUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects ve…
-
Critical 9.8
ProfilePress 3.0 - 3.1.3 - Unauthenticated Privilege Escalation
A vulnerability in the user registration component found in the ~/src/Classes/RegistrationAuth.php file of the ProfilePress WordPress plugin made it possible for users to register on sites as an administrator. This issue affects versions 3.0.0 - 3.1.3. .
-
Critical 9.8
ProfilePress 3.0 - 3.1.3 - Arbitrary File Upload in Image Uploader Component
A vulnerability in the image uploader component found in the ~/src/Classes/ImageUploader.php file of the ProfilePress WordPress plugin made it possible for users to upload arbitrary files during user registration or during profile updates. This issue affects …
-
High 8.8
CSRF in WP Fluent Forms < 3.6.67 allows stored XSS and Privilege Escalation
The WP Fluent Forms plugin < 3.6.67 for WordPress is vulnerable to Cross-Site Request Forgery leading to stored Cross-Site Scripting and limited Privilege Escalation due to a missing nonce check in the access control function for administrative AJAX actions
-
Critical 9.8CVE-2021-34622 Scanner template
ProfilePress 3.0 - 3.1.3 - Authenticated Privilege Escalation
A vulnerability in the user profile update component found in the ~/src/Classes/EditUserProfile.php file of the ProfilePress WordPress plugin made it possible for users to escalate their privileges to that of an administrator while editing their profile. This…
-
Critical 9.8
Prototype polluation in just-safe-set
Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
-
High 7.1
A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6…
-
High 8.3
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
KEV Oct 6, 2025 -
Medium 4.7
Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross…
-
Medium 4.9
Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability …
-
Medium 6.1
A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker t…
-
Low 3.5
A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject acces…
-
Unscored —
[20210705] - Core - XSS in com_media imagelist
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.
-
Unscored —
[20210703] - Core - Lack of enforced session termination
An issue was discovered in Joomla! 2.5.0 through 3.9.27. CMS functions did not properly termine existing user sessions when a user's password was changed or the user was blocked.
-
Unscored —
[20210704] - Core - Privilege escalation through com_installer
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Install action in com_installer lack the required hardcoded ACL checks for superusers. A default system is not affected cause the default ACL for com_installer is limited to super users already.
-
Unscored —
[20210702] - Core - DoS through usergroup table manipulation
An issue was discovered in Joomla! 2.5.0 through 3.9.27. Missing validation of input could lead to a broken usergroups table.
-
Unscored —
[20210701] - Core - XSS in JForm Rules field
An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in WPCS - WordPress Currency Switcher 1.1.6 and earlier allows remote a…
-
Unscored —
Cross-site request forgery (CSRF) vulnerability in WordPress Email Template Designer - WP HTML Mail versions prior to 3…
-
Unscored —
Improper authorization in handler for custom URL scheme vulnerability in GU App for Android versions from 4.8.0 to 5.0.…
-
Unscored —
Improper authentication vulnerability in SCT-40CM01SR and AT-40CM01SR allows an attacker to bypass access restriction a…
-
Unscored —
WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, …
-
Unscored —
WRC-1167FS-W, WRC-1167FS-B, and WRC-1167FSA all versions allow an unauthenticated network-adjacent attacker to obtain s…
-
Unscored —
kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification, aka CID-0c18f29aae7c. Without CON…
-
Medium 6.1
Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feat…
-
Medium 6.5
An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 1…
-
Medium 6.5
Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in Git…
-
Unscored —CVE-2020-23697 Scanner template
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php.
-
Low 3.5
HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE
-
Medium 5.9
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it wa…
-
Unscored —
Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the …
-
Unscored —
Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding…