CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-26800
https://notcve.org/view.php?id=CVE-2021-26800
16 Dec 2021 — Cross Site Request Forgery (CSRF) vulnerability in Change-password.php in phpgurukul user management system in php using stored procedure V1.0, allows attackers to change the password to an arbitrary account. Una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) en el archivo Change-password.php en phpgurukul user management system in php usando procedimiento de almacenamiento versión V1.0, permite a atacantes cambiar la contraseña a una cuenta arbitraria • https://gist.github.com/Kavisha3/59dac95b268f0d32eab53e659ab59311 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-43692
https://notcve.org/view.php?id=CVE-2021-43692
29 Nov 2021 — youtube-php-mirroring (last update Jun 9, 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php. youtube-php-mirroring (última actualización 9 de junio de 2017) está afectado por una vulnerabilidad de Cross Site Scripting (XSS) en el archivo ytproxy/index.php • https://github.com/zxq2233/youtube-php-mirroring/issues/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 7EXPL: 1CVE-2021-21707 – Special characters break path parsing in XML functions
https://notcve.org/view.php?id=CVE-2021-21707
29 Nov 2021 — In PHP versions 7.3.x below 7.3.33, 7.4.x below 7.4.26 and 8.0.x below 8.0.13, certain XML parsing functions, like simplexml_load_file(), URL-decode the filename passed to them. If that filename contains URL-encoded NUL character, this may cause the function to interpret this as the end of the filename, thus interpreting the filename differently from what the user intended, which may lead it to reading a different file than intended. En PHP versiones 7.3.x anteriores a 7.3.33, 7.4.x anteriores a 7.4.26 y 8.... • https://bugs.php.net/bug.php?id=79971 • CWE-20: Improper Input Validation CWE-159: Improper Handling of Invalid Use of Special Elements •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2021-42078 – PHP Event Calendar Lite Edition Cross Site Scripting
https://notcve.org/view.php?id=CVE-2021-42078
05 Nov 2021 — PHP Event Calendar through 2021-11-04 allows persistent cross-site scripting (XSS), as demonstrated by the /server/ajax/events_manager.php title parameter. This can be exploited by an adversary in multiple ways, e.g., to perform actions on the page in the context of other users, or to deface the site. PHP Event Calendar versiones hasta el 04-11-2021 permite un ataque de tipo cross-site scripting (XSS) persistente, como es demostrado por el parámetro de título /server/ajax/events_manager.php. Esto puede ser ... • https://packetstorm.news/files/id/164783 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-18263
https://notcve.org/view.php?id=CVE-2020-18263
03 Nov 2021 — PHP-CMS v1.0 was discovered to contain a SQL injection vulnerability in the component search.php via the search parameter. This vulnerability allows attackers to access sensitive database information. Se ha detectado que PHP-CMS versión v1.0, contiene una vulnerabilidad de inyección SQL en el componente search.php por medio del parámetro search. Esta vulnerabilidad permite a atacantes acceder a información confidencial de la base de datos • https://github.com/harshitbansal373/PHP-CMS/issues/1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.6EPSS: 0%CPEs: 1EXPL: 0CVE-2020-23754
https://notcve.org/view.php?id=CVE-2020-23754
02 Nov 2021 — Cross Site Scripting (XSS) vulnerability in infusions/member_poll_panel/poll_admin.php in PHP-Fusion 9.03.50, allows attackers to execute arbitrary code, via the polls feature. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en el archivo infusions/member_poll_panel/poll_admin.php en PHP-Fusion 9.03.50, permite a atacantes ejecutar código arbitrario, por medio de la funcionalidad polls • https://github.com/php-fusion/PHP-Fusion/issues/2315 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 1CVE-2021-21703 – PHP-FPM memory access in root process leading to privilege escalation
https://notcve.org/view.php?id=CVE-2021-21703
25 Oct 2021 — In PHP versions 7.3.x up to and including 7.3.31, 7.4.x below 7.4.25 and 8.0.x below 8.0.12, when running PHP FPM SAPI with main FPM daemon process running as root and child worker processes running as lower-privileged users, it is possible for the child processes to access memory shared with the main process and write to it, modifying it in a way that would cause the root process to conduct invalid memory reads and writes, which can be used to escalate privileges from local unprivileged user to the root us... • http://www.openwall.com/lists/oss-security/2021/10/26/7 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-284: Improper Access Control CWE-787: Out-of-bounds Write •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2021-40188
https://notcve.org/view.php?id=CVE-2021-40188
11 Oct 2021 — PHPFusion 9.03.110 is affected by an arbitrary file upload vulnerability. The File Manager function in admin panel does not filter all PHP extensions such as ".php, .php7, .phtml, .php5, ...". An attacker can upload a malicious file and execute code on the server. PHPFusion versión 9.03.110, está afectado por una vulnerabilidad de carga de archivos arbitraria. La función File Manager en el panel de administración no filtra todas las extensiones de PHP como ".php, .php7, .phtml, .php5, ...". • https://github.com/PHPFusion/PHPFusion/issues/2372 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 7.2EPSS: 2%CPEs: 1EXPL: 1CVE-2021-40189
https://notcve.org/view.php?id=CVE-2021-40189
11 Oct 2021 — PHPFusion 9.03.110 is affected by a remote code execution vulnerability. The theme function will extract a file to "webroot/themes/{Theme Folder], where an attacker can access and execute arbitrary code. PHPFusion versión 9.03.110, está afectado por una vulnerabilidad de ejecución de código remota . La función theme extrae un archivo a "webroot/themes/{Theme Folder], donde un atacante puede acceder y ejecutar código arbitrario • https://github.com/PHPFusion/PHPFusion/issues/2374 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2021-40541
https://notcve.org/view.php?id=CVE-2021-40541
11 Oct 2021 — PHPFusion 9.03.110 is affected by cross-site scripting (XSS) in the preg patterns filter html tag without "//" in descript() function An authenticated user can trigger XSS by appending "//" in the end of text. PHPFusion versión 9.03.110, está afectado por una vulnerabilidad de tipo cross-site scripting (XSS) en la etiqueta html preg patterns filter sin "//" en la función descript() Un usuario autenticado puede desencadenar un ataque de tipo XSS añadiendo "//" al final del texto • https://github.com/PHPFusion/PHPFusion/issues/2373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •