Total
420935 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-36568 | 2 Fedoraproject, Moodle | 2 Fedora, Moodle | 2026-06-17 | N/A | 5.4 MEDIUM |
| In certain Moodle products after creating a course, it is possible to add in a arbitrary "Topic" a resource, in this case a "Database" with the type "Text" where its values "Field name" and "Field description" are vulnerable to Cross Site Scripting Stored(XSS). This affects Moodle 3.11 and Moodle 3.10.4 and Moodle 3.9.7. | |||||
| CVE-2021-36567 | 1 Thinkphp | 1 Thinkphp | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache. | |||||
| CVE-2021-36564 | 1 Thinkphp | 1 Thinkphp | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php. | |||||
| CVE-2021-36563 | 1 Checkmk | 1 Checkmk | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts), the XSS payload will be triggered when the user accesses some specific sections of the application. In the same sense a very dangerous potential way would be when an attacker who has the monitor role (not administrator) manages to get a stored XSS to steal the secretAutomation (for the use of the API in administrator mode) and thus be able to create another administrator user who has high privileges on the CheckMK monitoring web console. Another way is that persistent XSS allows an attacker to modify the displayed content or change the victim's information. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session. | |||||
| CVE-2021-36560 | 1 Phone Shop Sales Management System Project | 1 Phone Shop Sales Management System | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Phone Shop Sales Managements System using PHP with Source Code 1.0 is vulnerable to authentication bypass which leads to account takeover of the admin. | |||||
| CVE-2021-36551 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-calendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Add Event module. | |||||
| CVE-2021-36550 | 1 Tiki | 1 Tikiwiki Cms\/groupware | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| TikiWiki v21.4 was discovered to contain a cross-site scripting (XSS) vulnerability in the component tiki-browse_categories.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload under the Create category module. | |||||
| CVE-2021-36548 | 1 Monstra | 1 Monstra | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog of Monstra v3.0.4 allows attackers to execute arbitrary commands via a crafted PHP file. | |||||
| CVE-2021-36547 | 1 Mara Cms Project | 1 Mara Cms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| A remote code execution (RCE) vulnerability in the component /codebase/dir.php?type=filenew of Mara v7.5 allows attackers to execute arbitrary commands via a crafted PHP file. | |||||
| CVE-2021-36546 | 1 Kitesky | 1 Kitecms | 2026-06-17 | N/A | 7.5 HIGH |
| Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL. | |||||
| CVE-2021-36545 | 1 Tpcms Project | 1 Tpcms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page. | |||||
| CVE-2021-36544 | 1 Tpcms Project | 1 Tpcms | 2026-06-17 | N/A | 7.5 HIGH |
| Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL. | |||||
| CVE-2021-36543 | 1 Seeddms | 1 Seeddms | 2026-06-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.UnlockDocument.php in SeedDMS v5.1.x <5.1.23 and v6.0.x <6.0.16 allows a remote attacker to unlock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | |||||
| CVE-2021-36542 | 1 Seeddms | 1 Seeddms | 2026-06-17 | 4.3 MEDIUM | 4.3 MEDIUM |
| Cross-Site Request Forgery (CSRF) vulnerability in the /op/op.LockDocument.php in SeedDMS v5.1.x<5.1.23 and v6.0.x <6.0.16 allows a remote attacker to lock any document without victim's knowledge, by enticing an authenticated user to visit an attacker's web page. | |||||
| CVE-2021-36539 | 1 Instructure | 1 Canvas Learning Management Service | 2026-06-17 | N/A | 6.5 MEDIUM |
| Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL (canvadoc_session_url). | |||||
| CVE-2021-36538 | 1 Gurock | 1 Testrail | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports. | |||||
| CVE-2021-36535 | 1 Cesanta | 1 Mjs | 2026-06-17 | N/A | 5.5 MEDIUM |
| Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf. | |||||
| CVE-2021-36532 | 1 Portfoliocms Project | 1 Portfoliocms | 2026-06-17 | N/A | 8.1 HIGH |
| Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost/admin/uploads.php. | |||||
| CVE-2021-36531 | 1 Miniupnp Project | 1 Ngiflib | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| ngiflib 0.4 has a heap overflow in GetByte() at ngiflib.c:70 in NGIFLIB_NO_FILE mode, GetByte() reads memory buffer without checking the boundary. | |||||
| CVE-2021-36530 | 1 Miniupnp Project | 1 Ngiflib | 2026-06-17 | 6.8 MEDIUM | 8.8 HIGH |
| ngiflib 0.4 has a heap overflow in GetByteStr() at ngiflib.c:108 in NGIFLIB_NO_FILE mode, GetByteStr() copy memory buffer without checking the boundary. | |||||