Total
421868 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-47962 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| Savsoft Quiz 5.0 contains a persistent cross-site scripting vulnerability in the user account settings page that allows authenticated attackers to inject malicious HTML and JavaScript code. Attackers can inject script payloads into user profile fields at the edit_user endpoint, which execute in the browsers of users viewing the affected profile after submission. | |||||
| CVE-2021-47961 | 1 Synology | 1 Ssl Vpn Client | 2026-06-17 | N/A | 8.1 HIGH |
| A plaintext storage of a password vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access or influence the user's PIN code due to insecure storage. This may lead to unauthorized VPN configuration and potential interception of subsequent VPN traffic when combined with user interaction. | |||||
| CVE-2021-47960 | 1 Synology | 1 Ssl Vpn Client | 2026-06-17 | N/A | 6.5 MEDIUM |
| A files or directories accessible to external parties vulnerability in Synology SSL VPN Client before 1.4.5-0684 allows remote attackers to access files within the installation directory via a local HTTP server bound to the loopback interface. By leveraging user interaction with a crafted web page, attackers may retrieve sensitive files such as configuration files, certificates, and logs, leading to information disclosure. | |||||
| CVE-2021-47959 | 2026-06-17 | N/A | 7.5 HIGH | ||
| WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQL queries with duplicated fields. Attackers can send POST requests to the GraphQL endpoint with amplified field duplication payloads to trigger server out-of-memory conditions and MySQL connection errors. | |||||
| CVE-2021-47958 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources. | |||||
| CVE-2021-47957 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the Bar Message field. Attackers can inject script payloads through the plugin settings page that execute in the browsers of all WordPress users viewing the site, enabling cookie theft and sensitive data exfiltration. | |||||
| CVE-2021-47956 | 2026-06-17 | N/A | 8.2 HIGH | ||
| EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive database information. | |||||
| CVE-2021-47955 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the file upload functionality. Attackers can upload SVG files containing embedded script tags to the browse.php endpoint, which are then executed in users' browsers when the files are accessed or previewed. | |||||
| CVE-2021-47954 | 2026-06-17 | N/A | 8.2 HIGH | ||
| LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query parameter. Attackers can send POST requests to /search.php with malicious search_query values using CASE WHEN statements to extract sensitive database information. | |||||
| CVE-2021-47942 | 1 Hacs | 1 Home Assistant Community Store | 2026-06-17 | N/A | 7.5 HIGH |
| Home Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances. | |||||
| CVE-2021-47934 | 2026-06-17 | N/A | 5.3 MEDIUM | ||
| MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fields like Location and Bio. Attackers can also exploit a cross-site request forgery vulnerability in the timeline.php profile action to change a user's cover picture by crafting malicious forms that execute when victims visit affected profiles. | |||||
| CVE-2021-47921 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| Free Photo & Video Vault 0.0.2 contains a directory traversal web vulnerability that allows remote attackers to manipulate application path requests and access sensitive system files. Attackers can exploit the vulnerability without privileges to retrieve environment variables and access unauthorized system paths. | |||||
| CVE-2021-47920 | 2026-06-17 | N/A | 5.4 MEDIUM | ||
| WebMO Job Manager 20.0 contains a cross-site scripting vulnerability in search parameters that allows remote attackers to inject malicious script code. Attackers can exploit the filterSearch and filterSearchType parameters to perform non-persistent attacks including session hijacking and external redirects. | |||||
| CVE-2021-47919 | 1 Simplephpscripts | 1 Simple Cms Php | 2026-06-17 | N/A | 6.4 MEDIUM |
| Simple CMS 2.1 contains a non-persistent cross-site scripting vulnerability in the preview.php file's id parameter. Attackers can inject malicious script code through a GET request to execute arbitrary scripts and potentially hijack user sessions or perform phishing attacks. | |||||
| CVE-2021-47918 | 1 Simplephpscripts | 1 Simple Cms Php | 2026-06-17 | N/A | 8.1 HIGH |
| Simple CMS 2.1 contains a remote SQL injection vulnerability that allows privileged attackers to inject unfiltered SQL commands in the users module. Attackers can exploit unvalidated input parameters in the admin.php file to compromise the database management system and web application. | |||||
| CVE-2021-47917 | 1 Simplephpscripts | 1 Simple Cms Php | 2026-06-17 | N/A | 6.4 MEDIUM |
| Simple CMS 2.1 contains a persistent cross-site scripting vulnerability in user input parameters that allows remote attackers to inject malicious script code. Attackers can exploit the newUser and editUser modules to inject persistent scripts that execute on user list preview, potentially leading to session hijacking and application manipulation. | |||||
| CVE-2021-47915 | 1 Phpsugar | 1 Php Melody | 2026-06-17 | N/A | 8.1 HIGH |
| PHP Melody version 3.0 contains a remote SQL injection vulnerability in the video edit module that allows authenticated attackers to inject malicious SQL commands. Attackers can exploit the unvalidated 'vid' parameter to execute arbitrary database queries and potentially compromise the web application and database management system. | |||||
| CVE-2021-47914 | 1 Phpsugar | 1 Php Melody | 2026-06-17 | N/A | 6.4 MEDIUM |
| PHP Melody version 3.0 contains a persistent cross-site scripting vulnerability in the edit-video.php submitted parameter that allows remote attackers to inject malicious script code. Attackers can exploit this vulnerability to execute arbitrary JavaScript, potentially leading to session hijacking, persistent phishing, and manipulation of application modules. | |||||
| CVE-2021-47913 | 1 Phpsugar | 1 Php Melody | 2026-06-17 | N/A | 6.4 MEDIUM |
| PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers can exploit the WYSIWYG editor to execute persistent scripts, potentially leading to session hijacking and application manipulation. | |||||
| CVE-2021-47912 | 1 Phpsugar | 1 Php Melody | 2026-06-17 | N/A | 6.4 MEDIUM |
| PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject malicious scripts through unvalidated parameters to execute client-side attacks and potentially hijack user sessions. | |||||