Security Vulnerabilities - CVEs Published In 2021
DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.
CVSS Score
6.1
EPSS Score
0.01
Published
2021-08-26
Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threat actor to access privileged functionality, leading to OS command execution. The specific attack methodology is a file upload.
CVSS Score
9.8
EPSS Score
0.035
Published
2021-08-26
It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint.
CVSS Score
6.1
EPSS Score
0.009
Published
2021-08-26
An SSRF vulnerability in Gotenberg through 6.2.1 exists in the remote URL to PDF conversion, which results in a remote attacker being able to read local files or fetch intranet resources.
CVSS Score
7.5
EPSS Score
0.017
Published
2021-08-26
A stored cross-site scripting (XSS) vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to execute arbitrary web scripts or HTML.
CVSS Score
5.4
EPSS Score
0.005
Published
2021-08-26
thinkphp-zcms as of 20190715 allows SQL injection via index.php?m=home&c=message&a=add.
CVSS Score
9.8
EPSS Score
0.01
Published
2021-08-26
Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload.
CVSS Score
6.1
EPSS Score
0.006
Published
2021-08-26
A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter.
CVSS Score
8.8
EPSS Score
0.009
Published
2021-08-26
A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters.
CVSS Score
7.2
EPSS Score
0.028
Published
2021-08-26
A cross-site scripting (XSS) vulnerability in the referer parameter of Dzzoffice 2.02 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVSS Score
6.1
EPSS Score
0.007
Published
2021-08-26