Total
421867 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-47781 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition through a maliciously crafted .cmd file. Attackers can create a specially constructed .cmd file with repeated characters to overwhelm the console emulator's buffer and crash the application. | |||||
| CVE-2021-47780 | 1 Macro-expert | 1 Macro Expert | 2026-06-17 | N/A | 7.8 HIGH |
| Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the improperly configured service path to inject malicious executables that will be run with LocalSystem permissions during service startup. | |||||
| CVE-2021-47779 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-06-17 | N/A | 5.4 MEDIUM |
| Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious scripts. Attackers can craft a specially designed ticket message with embedded JavaScript that triggers when an administrator copies the text, potentially enabling privilege escalation. | |||||
| CVE-2021-47778 | 1 Get-simple | 1 Getsimplecms | 2026-06-17 | N/A | 7.2 HIGH |
| GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through plugin configuration parameters, leading to remote code execution on the server. | |||||
| CVE-2021-47777 | 2026-06-17 | N/A | 8.2 HIGH | ||
| Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inject stacked SQL queries using payloads like ';WAITFOR DELAY '0:0:3'-- to manipulate database queries and potentially extract or modify database information. | |||||
| CVE-2021-47775 | 2026-06-17 | N/A | 8.4 HIGH | ||
| YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious payload of 712 bytes with SEH manipulation to trigger a bind shell connection on a specified local port. | |||||
| CVE-2021-47774 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| Kingdia CD Extractor 3.0.2 contains a buffer overflow vulnerability in the registration name field that allows attackers to execute arbitrary code. Attackers can craft a malicious payload exceeding 256 bytes to overwrite Structured Exception Handler and gain remote code execution through a bind shell. | |||||
| CVE-2021-47773 | 1 Dynojet | 1 Power Core | 2026-06-17 | N/A | 7.8 HIGH |
| Dynojet Power Core 2.3.0 contains an unquoted service path vulnerability in the DJ.UpdateService that allows local authenticated users to potentially execute code with elevated privileges. Attackers can exploit the unquoted binary path by placing malicious executables in the service's file path to gain Local System access. | |||||
| CVE-2021-47772 | 1 10-strike | 1 Network Inventory Explorer | 2026-06-17 | N/A | 9.8 CRITICAL |
| 10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution. Attackers can craft a malicious text file with carefully constructed payload to trigger a reverse shell and execute arbitrary code on the target system. | |||||
| CVE-2021-47771 | 1 Cinspiration | 1 Rdp Manager | 2026-06-17 | N/A | 5.5 MEDIUM |
| RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can add oversized entries in Verbindungsname and Server fields to permanently freeze and crash the software, potentially requiring full reinstallation. | |||||
| CVE-2021-47770 | 2026-06-17 | N/A | 8.8 HIGH | ||
| OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration interface. Attackers can upload a custom hardware layer with embedded reverse shell code that establishes a network connection to a specified IP and port, enabling remote command execution. | |||||
| CVE-2021-47769 | 1 Bdtask | 1 Isshue | 2026-06-17 | N/A | 4.8 MEDIUM |
| Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers with privileged user accounts can inject malicious scripts that execute on preview, potentially enabling session hijacking and persistent phishing attacks. | |||||
| CVE-2021-47768 | 1 Cleidigh | 1 Importexporttools Ng | 2026-06-17 | N/A | 6.1 MEDIUM |
| ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials. | |||||
| CVE-2021-47767 | 1 10-strike | 1 Network Inventory Explorer | 2026-06-17 | N/A | 7.8 HIGH |
| 10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path segments to achieve privilege escalation and execute code with system-level permissions. | |||||
| CVE-2021-47766 | 2026-06-17 | N/A | 7.1 HIGH | ||
| Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate database queries. Attackers can exploit this vulnerability using boolean-based, error-based, and time-based blind SQL injection techniques to potentially extract or manipulate database information. | |||||
| CVE-2021-47765 | 1 Celestialsoftware | 1 Absolutetelnet | 2026-06-17 | N/A | 5.5 MEDIUM |
| AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report fields. Attackers can trigger the crash by inserting 1000 characters into the username or email address fields, causing the application to become unresponsive. | |||||
| CVE-2021-47764 | 1 Celestialsoftware | 1 Absolutetelnet | 2026-06-17 | N/A | 5.5 MEDIUM |
| AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and license name fields. Attackers can generate a 1000-character payload and paste it into specific input fields to trigger application crashes and force unexpected termination. | |||||
| CVE-2021-47762 | 2026-06-17 | N/A | 7.8 HIGH | ||
| HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables and gain elevated access to the system. | |||||
| CVE-2021-47761 | 2026-06-17 | N/A | 7.8 HIGH | ||
| MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin directory. Attackers can replace the mysqld.exe with a malicious executable, which will execute with system privileges when the computer restarts. | |||||
| CVE-2021-47759 | 2026-06-17 | N/A | 6.2 MEDIUM | ||
| MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerShell process listing. Attackers can run a PowerShell command to retrieve the full command line of MTPutty processes, exposing plaintext SSH credentials. | |||||