Skip to content
OpenAdvisories

Archive

27 December 2021

Vulnerabilities first published on this day (UTC), newest first.

← November 2021 2021 / December /27 January 2022 →
  1. 176
  2. 238
  3. 331
  4. 41
  5. 57
  6. 655
  7. 7135
  8. 8138
  9. 954
  10. 1033
  11. 112
  12. 123
  13. 13108
  14. 14116
  15. 15255
  16. 1644
  17. 1766
  18. 183
  19. 193
  20. 2073
  21. 2166
  22. 22117
  23. 2394
  24. 2417
  25. 2532
  26. 26244
  27. 2755
  28. 2828
  29. 2921
  30. 3050
  31. 3134
All Critical High Medium Low Exploited only Public exploit

55 results · Feed

  • Unscored —
    CVE-2021-45788

    Time-based SQL Injection vulnerabilities were found in Metersphere v1.15.4 via the "orders" parameter.

  • Unscored —
    CVE-2021-45843

    glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting (XSS) vulnerability. The value of the title request…

  • Unscored —
    CVE-2021-24997 Scanner template

    WP Guppy < 1.3 - Sensitive Information Disclosure

    The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to sen…

    Web / CMS
  • Unscored —
    CVE-2021-24998

    Simple JWT Login < 3.3.0 - Insecure Password Creation

    The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and …

    Web / CMS
  • Unscored —
    CVE-2021-24992

    Buttonizer - Smart Floating Action Button < 2.5.5 - Admin+ Stored Cross-Site Scripting

    The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltere…

    Web / CMS
  • Unscored —
    CVE-2021-24984

    WPFront User Role Editor < 3.2.1.11184 - Reflected Cross-Site Scripting

    The WPFront User Role Editor WordPress plugin before 3.2.1.11184 does not sanitise and escape the changes-saved parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting

    Web / CMS
  • Unscored —
    CVE-2021-24988

    WP RSS Aggregator < 4.19.3 - Subscriber+ Stored Cross-Site Scripting

    The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard, which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and …

    Web / CMS
  • Unscored —
    CVE-2021-24980

    Gwolle Guestbook < 4.2.0 - Reflected Cross-Site Scripting

    The Gwolle Guestbook WordPress plugin before 4.2.0 does not sanitise and escape the gwolle_gb_user_email parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in an admin page

    Web / CMS
  • Unscored —
    CVE-2021-24979 Scanner template

    Paid Memberships Pro < 2.6.6 - Reflected Cross-Site Scripting

    The Paid Memberships Pro WordPress plugin before 2.6.6 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting

    Web / CMS
  • Unscored —
    CVE-2021-24967

    Contact Form & Lead Form Elementor Builder < 1.6.4 - Unauthenticated Stored Cross-Site Scripting

    The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.6.4 does not sanitise and escape some lead values, which could allow unauthenticated users to perform Cross-Site Scripting attacks against logged in admin viewing the inserted Leads

    Web / CMS
  • Unscored —
    CVE-2021-24969

    Download Manager < 3.2.22 - Subscriber+ Stored Cross-Site Scripting

    The WordPress Download Manager WordPress plugin before 3.2.22 does not sanitise and escape Template data before outputting it in various pages (such as admin dashboard and frontend). Due to the lack of authorisation and CSRF checks in the wpdm_save_template A…

    Web / CMS
  • Unscored —
    CVE-2021-24902

    Typebot < 1.4.3 - Admin+ Stored Cross Site Scripting

    The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is di…

    Web / CMS
  • Unscored —
    CVE-2021-24797

    Tickera < 3.4.8.3 - Unauthenticated Stored Cross-Site Scripting

    The Tickera WordPress plugin before 3.4.8.3 does not properly sanitise and escape the Name fields of booked Events before outputting them in the Orders admin dashboard, which could allow unauthenticated users to perform Cross-Site Scripting attacks against ad…

    Web / CMS
  • Unscored —
    CVE-2021-24753

    Rich Reviews by Starfish < 1.9.6 - Admin+ SQL Injection

    The Rich Reviews by Starfish WordPress plugin before 1.9.6 does not properly validate the orderby GET parameter of the pending reviews page before using it in a SQL statement, leading to an authenticated SQL injection issue

    Web / CMS
  • High 8.2
    CVE-2021-43845

    Prevent out-of-bounds read in PJSIP

    PJSIP is a free and open source multimedia communication library. In version 2.11.1 and prior, if incoming RTCP XR message contain block, the data field is not checked against the received packet size, potentially resulting in an out-of-bound read access. Thi…

    pjsip pjproject asterisk asterisk Debian Ubuntu Alpine