cve.bz

Matching records, newest first, page 95

Filter
  1. 7.5CVE-2021-27320ExploitEPSS 9.3%

    Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via firstname parameter.

  2. 7.5CVE-2021-27319ExploitEPSS 7.8%

    Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via email parameter.

  3. 7.5CVE-2021-27316ExploitEPSS 7.8%

    Blind SQL injection in contactus.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via lastname parameter.

  4. 7.5CVE-2021-27315ExploitEPSS 7.8%

    Blind SQL injection in contactus.php in Doctor Appointment System 1.0 allows an unauthenticated attacker to insert malicious SQL queries via the comment parameter.

  5. 5.5CVE-2021-29133ExploitEPSS 1.1%

    Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

  6. 6.5CVE-2021-21402ExploitEPSS 79%

    Jellyfin is a Free Software Media System. In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. This issue is more prevalent when Windows is us…

  7. 6.1CVE-2021-27310ExploitEPSS 2.8%

    Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "language" parameter.

  8. 6.1CVE-2021-27309ExploitEPSS 2.0%

    Clansphere CMS 2011.4 allows unauthenticated reflected XSS via "module" parameter.

  9. 9.1CVE-2021-21351ExploitEPSS 82%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the pro…

  10. 9.9CVE-2021-21345ExploitEPSS 72%

    XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulati…

  11. 4.8CVE-2021-27308ExploitEPSS 2.0%

    A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.

  12. 9.8CVE-2021-26295ExploitEPSS 98%

    Apache OFBiz has unsafe deserialization prior to 17.12.06. An unauthenticated attacker can use this vulnerability to successfully take over Apache OFBiz.

  13. 6.1CVE-2021-27520ExploitEPSS 6.4%

    A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.

  14. 6.1CVE-2021-27519ExploitEPSS 7.6%

    A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.

  15. 7.2CVE-2021-27928ExploitEPSS 38%

    A remote code execution issue was discovered in MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL. An untruste…

  16. 7.5CVE-2021-27358ExploitEPSS 83%

    The snapshot feature in Grafana 6.7.3 through 7.4.1 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.

  17. 7.5CVE-2021-24146ExploitEPSS 31%

    Lack of authorisation checks in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly restrict access to the export files, allowing unauthenticated users to exports all events data in CSV or XML format …

  18. 7.2CVE-2021-24145ExploitEPSS 88%

    Arbitrary file upload in the Modern Events Calendar Lite WordPress plugin, versions before 5.16.5, did not properly check the imported file, allowing PHP ones to be uploaded by administrator by using the 'text/csv' content-type in the requ…

  19. 9.8CVE-2021-24139ExploitEPSS 5.5%

    Unvalidated input in the Photo Gallery (10Web Photo Gallery) WordPress plugin, versions before 1.5.55, leads to SQL injection via the frontend/models/model.php bwg_search_x parameter.

  20. 4.8CVE-2021-28420ExploitEPSS 1.9%

    A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the "from_time" parameter.

  21. 7.2CVE-2021-28419ExploitEPSS 11%

    The "order_col" parameter in archive.php of SEO Panel 4.8.0 is vulnerable to time-based blind SQL injection, which leads to the ability to retrieve all databases.

  22. 4.8CVE-2021-28418ExploitEPSS 1.9%

    A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter.

  23. 4.8CVE-2021-28417ExploitEPSS 1.9%

    A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the "search_name" parameter.

  24. 8.8CVE-2021-27946ExploitEPSS 4.2%

    SQL Injection vulnerability in MyBB before 1.8.26 via poll vote count. (issue 1 of 3).

  25. 8.8CVE-2021-27890ExploitEPSS 11%

    SQL Injection vulnerablity in MyBB before 1.8.26 via theme properties included in theme XML files.

  26. 6.1CVE-2021-27889ExploitEPSS 5.1%

    Cross-site Scripting (XSS) vulnerability in MyBB before 1.8.26 via Nested Auto URL when parsing messages.

  27. 6.1CVE-2021-27695ExploitEPSS 3.0%

    Multiple stored cross-site scripting (XSS) vulnerabilities in openMAINT 2.1-3.3-b allow remote attackers to inject arbitrary web script or HTML via any "Add" sections, such as Add Card Building & Floor, or others in the Name and Code Param…

  28. 8.8CVE-2021-28379ExploitEPSS 6.0%

    web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a different origin.

  29. 7.5CVE-2020-29238ExploitEPSS 16%

    An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request.

  30. 7.5CVE-2021-21300ExploitEPSS 89%

    Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out scr…

  31. 6.5CVE-2020-27838ExploitEPSS 18%

    A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client chang…

  32. 6.1CVE-2021-21337ExploitEPSS 8.4%

    Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and l…

  33. 7.5CVE-2021-26294ExploitEPSS 17%

    An issue was discovered in AfterLogic Aurora through 7.7.9 and WebMail Pro through 7.7.9. They allow directory traversal to read files (such as a data/settings/settings.xml file containing admin panel credentials), as demonstrated by dav/s…

  34. 6.1CVE-2021-3377ExploitEPSS 8.0%

    The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerabil…

  35. 8.6CVE-2020-29134ExploitEPSS 28%

    The TOTVS Fluig platform allows path traversal through the parameter "file = .. /" encoded in base64. This affects all versions Fluig Lake 1.7.0, Fluig 1.6.5 and Fluig 1.6.4

  36. 9.8CVE-2021-27964ExploitEPSS 48%

    SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension …

  37. 9.8CVE-2021-27314ExploitEPSS 12%

    SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.

  38. 6.1CVE-2020-24912ExploitEPSS 6.1%

    A reflected cross-site scripting (XSS) vulnerability in qcubed (all versions including 3.1.1) in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users.

  39. 9.1CVE-2021-27931ExploitEPSS 18%

    LumisXP (aka Lumis Experience Platform) before 10.0.0 allows unauthenticated blind XXE via an API request to PageControllerXml.jsp. One can send a request crafted with an XXE payload and achieve outcomes such as reading local server files …

  40. 9.8CVE-2021-21978ExploitEPSS 99.0%

    VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attack…

  41. 9.8CVE-2020-29047ExploitEPSS 16%

    The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.

  42. 7.8CVE-2021-27065KEVExploitEPSS 99.8%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  43. 9.1CVE-2021-26855KEVExploitEPSS >99.9%

    Microsoft Exchange Server Remote Code Execution Vulnerability

  44. 8.8CVE-2021-27885ExploitEPSS 3.2%

    usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.

  45. 5.4CVE-2020-23518ExploitEPSS 2.0%

    Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting, Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML.

  46. 8.8CVE-2021-27878KEVExploitEPSS 24%

    An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability i…

  47. 9.8CVE-2021-27877KEVExploitEPSS 65%

    An issue was discovered in Veritas Backup Exec before 21.2. It supports multiple authentication schemes: SHA authentication is one of these. This authentication scheme is no longer used in current versions of the product, but hadn't yet be…

  48. 8.1CVE-2021-27876KEVExploitEPSS 14%

    An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which is typically completed over a secure TLS communication. However, due to a vulnerability i…

  49. 6.1CVE-2021-26702ExploitEPSS 3.1%

    EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.

  50. 6.1CVE-2021-26475ExploitEPSS 7.3%

    EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.