Security Vulnerabilities - CVEs Published In 2021
engineercms 1.03 is vulnerable to Cross Site Scripting (XSS). There is no escaping in the nickname field on the user list page. When viewing this page, the JavaScript code will be executed in the user's browser.
CVSS Score
5.4
EPSS Score
0.006
Published
2021-07-30
Sourcecodester Online Covid Vaccination Scheduler System 1.0 is vulnerable to SQL Injection. The username parameter is vulnerable to time-based SQL injection. Upon successful dumping the admin password hash, an attacker can decrypt and obtain the plain-text password. Hence, the attacker could authenticate as Administrator.
CVSS Score
8.1
EPSS Score
0.021
Published
2021-07-30
Sourcecodester Phone Shop Sales Managements System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.
CVSS Score
9.8
EPSS Score
0.034
Published
2021-07-30
PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.
CVSS Score
7.5
EPSS Score
0.649
Published
2021-07-30
Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/environment/logging.php Logging::update_logging() method. User input passed through the logFile request parameter is not properly sanitized before being used in a call to the file_exists() PHP function. This can be exploited by malicious users to inject arbitrary PHP objects into the application scope (PHP Object Injection via phar:// stream wrapper), allowing them to carry out a variety of attacks, such as executing arbitrary PHP code.
CVSS Score
7.2
EPSS Score
0.037
Published
2021-07-30
replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local attacker to gain root privileges via a symlink attack on /tmp/replay-sorcery or /tmp/replay-sorcery/device.sock.
CVSS Score
7.8
EPSS Score
0.005
Published
2021-07-30
CSZ CMS 1.2.9 is vulnerable to Arbitrary File Deletion. This occurs in PHP when the unlink() function is called and user input might affect portions of or the whole affected parameter, which represents the path of the file to remove, without sufficient sanitization.
CVSS Score
9.1
EPSS Score
0.013
Published
2021-07-30
In Charm 0.43, any single user can decrypt DAC-MACS or MA-ABE-YJ14 data.
CVSS Score
6.5
EPSS Score
0.008
Published
2021-07-30
In Charm 0.43, any two users can collude to achieve the ability to decrypt YCT14 data.
CVSS Score
5.9
EPSS Score
0.009
Published
2021-07-30
PEEL Shopping version 9.4.0 allows remote SQL injection. A public user/guest (unauthenticated) can inject a malicious SQL query in order to affect the execution of predefined SQL commands. Upon a successful SQL injection attack, an attacker can read sensitive data from the database and possibly modify database data.
CVSS Score
9.1
EPSS Score
0.052
Published
2021-07-30