Archive
August 2021
Vulnerabilities first published in this month (UTC), newest first.
2,107 results · Feed
-
Unscored —
SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.
-
Unscored —
An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain…
-
Unscored —
A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an …
-
Unscored —CVE-2021-38751 Scanner template
A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can ch…
-
Unscored —
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
-
Unscored —
spirv_headers is unmaintained, use spirv instead
Because of versioning issues; the `spirv_headers` crate is unmaintained. Use [spirv](https://crates.io/crates/spirv) for parsing spirv files.
-
Unscored —CVE-2021-35392 EPSS 82%
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSD…
-
Unscored —CVE-2021-35393 EPSS 66%
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSD…
-
Critical 9.8
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled a…
KEV Dec 10, 2021 -
Critical 9.8
Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be …
KEV Nov 3, 2021 -
Unscored —
Mimetic Books <= 0.2.13 - Authenticated Stored Cross-Site Scripting (XSS)
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
-
Unscored —
Wonder PDF Embed < 1.7 - Contributor+ Stored XSS
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
-
Unscored —
Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)
The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting iss…
-
Unscored —
Wonder Video Embed < 1.8 - Contributor+ Stored XSS
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
-
Unscored —
Custom Login Redirect <= 1.0.0 - CSRF to Stored XSS
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
-
Unscored —
Light Messages <= 1.0 - CSRF to Stored XSS
The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the s…
-
Unscored —
PhoneTrack Meu Site Manager <= 0.1 - Authenticated Stored XSS
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
-
Unscored —CVE-2021-24527 Scanner template
Profile Builder < 3.4.9 - Admin Access via Password Reset
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, th…
-
Unscored —
Form Maker < 1.13.60 - Authenticated Stored XSS
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross…
-
Unscored —
Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticat…
-
Unscored —
WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSS
The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an aut…
-
Unscored —
Video Posts Webcam Recorder < 3.2.4 - Authenticated Reflected XSS
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
-
Unscored —
YouTube Embed < 5.2.2 - Contributor+ Stored XSS
The YouTube Embed WordPress plugin before 5.2.2 does not validate, escape or sanitise some of its shortcode attributes, leading to Stored XSS issues by 1. using w, h, controls, cc_lang, color, language, start, stop, or style parameter of youtube shortcode, 2.…
-
Unscored —
Verse-O-Matic <= 4.1.1 - CSRF to Stored XSS
The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation…
-
Unscored —
My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)
The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfiltered_html capability is disallowed, leading to an au…
-
Unscored —
Social Tape <= 1.0 - CSRF to Stored XSS
The Social Tape WordPress plugin through 1.0 does not have CSRF checks in place when saving its settings, and do not sanitise or escape them before outputting them back in the page, leading to a stored Cross-Site Scripting issue via a CSRF attack
-
Unscored —
Telugu Bible Verse Daily <= 1.0 - CSRF to Stored XSS
The తెలుగు బైబిల్ వచనములు WordPress plugin through 1.0 is lacking any CSRF check when saving its settings and verses, and do not sanitise or escape them when outputting them back in the page. This could allow attackers to make a logged in admin change the set…
-
Unscored —
Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF
The Shantz WordPress QOTD WordPress plugin through 1.2.2 is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values.
-
Unscored —
Photo Gallery < 1.5.75 - File Upload Path Traversal
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal ve…
-
Unscored —
Photo Gallery < 1.5.75 - Stored Cross-Site Scripting via Uploaded SVG
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file co…
-
High 7.8
Arbitrary Code Injection
This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output.
-
Medium 5.5
Directory Traversal
This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing include, include-code or include-raw block is processed. The contents of arbitrary files could be disclosed in the HTML output.
-
Medium 5.3
No Authentication on Logging Server
If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authenti…
-
Unscored —CVE-2021-3708 EPSS 25%
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticat…
-
Unscored —CVE-2021-3707 Public exploit
D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modificatio…
-
Unscored —
OneNav 0.9.12 allows Information Disclosure of the onenav.db3 contents. NOTE: the vendor's recommended solution is to b…
-
Medium 5.4
Cross-site scripting in imgURL
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
-
Unscored —
In gitit before 0.15.0.0, the Export feature can be exploited to leak information from files.
-
Unscored —
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.
-
Unscored —
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system fo…