Security Vulnerabilities - CVEs Published In 2021
An unrestricted file upload on Simple Image Gallery Web App can be exploited to upload a web shell and executed to gain unauthorized access to the server hosting the web app.
CVSS Score
9.8
EPSS Score
0.015
Published
2021-08-16
SQL Injection vulnerability in Hospital Management System due to lack of input validation in messearch.php.
CVSS Score
9.8
EPSS Score
0.018
Published
2021-08-16
Unauthenticated doctor entry deletion in Hospital Management System in admin-panel1.php.
CVSS Score
5.3
EPSS Score
0.01
Published
2021-08-16
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.
CVSS Score
6.1
EPSS Score
0.007
Published
2021-08-16
Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.
CVSS Score
6.1
EPSS Score
0.009
Published
2021-08-16
Directory traversal vulnerability in Online Catering Reservation System 1.0 exists due to lack of validation in index.php.
CVSS Score
7.5
EPSS Score
0.023
Published
2021-08-16
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
CVSS Score
5.4
EPSS Score
0.006
Published
2021-08-16
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header.
CVSS Score
7.5
EPSS Score
0.821
Published
2021-08-16
Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. The binary is usually named wscd or mini_upnpd and is the successor to miniigd. The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. Successful exploitation of this vulnerability allows remote unauthenticated attackers to gain arbitrary code execution on the affected device.
CVSS Score
9.8
EPSS Score
0.664
Published
2021-08-16
CVE-2021-35394
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote unauthenticated attackers.
Known exploited
CVSS Score
9.8
EPSS Score
0.999
Published
2021-08-16