2021 CVEs (page 3)
Page 3 of 235 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47812 | Critical | 9.8 | 2026-01-16 | GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the sc… |
CVE-2021-47811 | Critical | 9.1 | 2026-01-16 | Grocery Crud 1.6.4 contains a SQL injection vulnerability in the order_by parameter that allows remote attackers to manipulate database queries. Attackers can… |
CVE-2021-47810 | High | 7.8 | 2026-01-16 | WibuKey Runtime 6.51 contains an unquoted service path vulnerability in the WkSvW32.exe service that allows local attackers to potentially execute arbitrary co… |
CVE-2021-47809 | High | 7.8 | 2026-01-16 | Disk Sorter Enterprise 13.6.12 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially… |
CVE-2021-47808 | Medium | 5.4 | 2026-01-16 | Cotonti Siena 0.9.19 contains a stored cross-site scripting vulnerability in the admin configuration panel's site title parameter. Attackers can inject malicio… |
CVE-2021-47807 | High | 7.8 | 2026-01-16 | Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arb… |
CVE-2021-47806 | High | 7.8 | 2026-01-16 | Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbit… |
CVE-2021-47805 | High | 7.8 | 2026-01-16 | Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbi… |
CVE-2021-47804 | High | 7.8 | 2026-01-16 | Wise Care 365 5.6.7.568 contains an unquoted service path vulnerability in the WiseBootAssistant service running with LocalSystem privileges. Attackers can exp… |
CVE-2021-47803 | High | 7.8 | 2026-01-16 | iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privil… |
CVE-2021-47801 | High | 8.2 | 2026-01-16 | Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit t… |
CVE-2021-47800 | Medium | 5.3 | 2026-01-16 | b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers c… |
CVE-2021-47798 | Critical | 9.8 | 2026-01-16 | NoteBurner 2.35 contains a buffer overflow vulnerability in the license code input field that allows attackers to crash the application. Attackers can generate… |
CVE-2021-47797 | High | 7.5 | 2026-01-16 | Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the a… |
CVE-2021-47796 | Critical | 9.8 | 2026-01-16 | Denver SHC-150 Smart Wifi Camera contains a hardcoded telnet credential vulnerability that allows unauthenticated attackers to access a Linux shell. Attackers… |
CVE-2021-47795 | Medium | 6.2 | 2026-01-16 | GeoVision GeoWebServer 5.3.3 contains multiple vulnerabilities including local file inclusion, cross-site scripting, and remote code execution through improper… |
CVE-2021-47794 | High | 8.8 | 2026-01-16 | ZesleCP 3.1.9 contains an authenticated remote code execution vulnerability that allows attackers to create malicious FTP accounts with shell injection payload… |
CVE-2021-47793 | High | 7.5 | 2026-01-16 | Telegram Desktop 2.9.2 contains a denial of service vulnerability that allows attackers to crash the application by sending an oversized message payload. Attac… |
CVE-2021-47792 | High | 7.8 | 2026-01-16 | Remote Mouse 4.002 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attac… |
CVE-2021-47791 | High | 7.5 | 2026-01-16 | SmartFTP Client 10.0.2909.0 contains multiple denial of service vulnerabilities that allow attackers to crash the application through specific input manipulati… |
CVE-2021-47790 | High | 7.8 | 2026-01-16 | Active WebCam 11.5 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attac… |
CVE-2021-47789 | High | 7.5 | 2026-01-16 | Yenkee Hornet Gaming Mouse driver GM312Fltr.sys contains a buffer overrun vulnerability that allows attackers to crash the system by sending oversized input. A… |
CVE-2021-47788 | High | 8.8 | 2026-01-16 | WebsiteBaker 2.13.0 contains an authenticated remote code execution vulnerability that allows users with language editing permissions to execute arbitrary code… |
CVE-2021-47787 | High | 7.8 | 2026-01-16 | TotalAV 5.15.69 contains an unquoted service path vulnerability in multiple system services running with LocalSystem privileges. Attackers can place malicious… |
CVE-2021-47786 | High | 7.5 | 2026-01-16 | Redragon Gaming Mouse driver contains a kernel-level vulnerability that allows attackers to trigger a denial of service by sending malformed IOCTL requests. At… |
CVE-2021-47785 | Critical | 9.8 | 2026-01-16 | Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a mali… |
CVE-2021-47783 | Medium | 5.4 | 2026-01-16 | Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can u… |
CVE-2021-47782 | High | 8.2 | 2026-01-16 | Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious databas… |
CVE-2021-47780 | High | 7.8 | 2026-01-16 | Macro Expert 4.7 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges… |
CVE-2021-47779 | Medium | 5.4 | 2026-01-16 | Dolibarr ERP-CRM 14.0.2 contains a stored cross-site scripting vulnerability in the ticket creation module that allows low-privilege users to inject malicious… |
CVE-2021-47756 | High | 8.4 | 2026-01-16 | Laravel Valet versions 1.1.4 to 2.0.3 contain a local privilege escalation vulnerability that allows users to modify the valet command with root privileges. At… |
CVE-2021-47843 | Medium | 5.4 | 2026-01-15 | Tagstoo 2.0.1 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious payloads through files or custom tags. Attackers c… |
CVE-2021-47819 | Critical | 9.8 | 2026-01-15 | ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution cap… |
CVE-2021-47799 | Medium | 6.2 | 2026-01-15 | Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. A… |
CVE-2021-47784 | High | 7.5 | 2026-01-15 | Cyberfox Web Browser 52.9.1 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the search bar with excess… |
CVE-2021-47781 | Critical | 9.8 | 2026-01-15 | Cmder Console Emulator 1.3.18 contains a buffer overflow vulnerability that allows attackers to trigger a denial of service condition through a maliciously cra… |
CVE-2021-47777 | High | 8.2 | 2026-01-15 | Build Smart ERP 21.0817 contains an unauthenticated SQL injection vulnerability in the 'eidValue' parameter of the login validation endpoint. Attackers can inj… |
CVE-2021-47776 | Medium | 5.3 | 2026-01-15 | Umbraco CMS v8.14.1 contains a server-side request forgery vulnerability that allows attackers to manipulate baseUrl parameters in multiple dashboard and help… |
CVE-2021-47775 | High | 8.4 | 2026-01-15 | YouTube Video Grabber, now referred to as YouTube Downloader, 1.9.9.1 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code… |
CVE-2021-47774 | Critical | 9.8 | 2026-01-15 | Kingdia CD Extractor 3.0.2 contains a buffer overflow vulnerability in the registration name field that allows attackers to execute arbitrary code. Attackers c… |
CVE-2021-47773 | High | 7.8 | 2026-01-15 | Dynojet Power Core 2.3.0 contains an unquoted service path vulnerability in the DJ.UpdateService that allows local authenticated users to potentially execute c… |
CVE-2021-47772 | Critical | 9.8 | 2026-01-15 | 10-Strike Network Inventory Explorer Pro 9.31 contains a buffer overflow vulnerability in the text file import functionality that allows remote code execution… |
CVE-2021-47771 | Medium | 5.5 | 2026-01-15 | RDP Manager 4.9.9.3 contains a denial of service vulnerability in connection input fields that allows local attackers to crash the application. Attackers can a… |
CVE-2021-47769 | Medium | 4.8 | 2026-01-15 | Isshue Shopping Cart 3.5 contains a persistent cross-site scripting vulnerability in title input fields across stock, customer, and invoice modules. Attackers… |
CVE-2021-47768 | Medium | 6.1 | 2026-01-15 | ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML… |
CVE-2021-47767 | High | 7.8 | 2026-01-15 | 10-Strike Network Inventory Explorer Pro 9.31 contains an unquoted service path vulnerability in the srvInventoryWebServer service running with LocalSystem pri… |
CVE-2021-47766 | High | 7.1 | 2026-01-15 | Kmaleon 1.1.0.205 contains an authenticated SQL injection vulnerability in the 'tipocomb' parameter of kmaleonW.php that allows attackers to manipulate databas… |
CVE-2021-47765 | Medium | 5.5 | 2026-01-15 | AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating username and error report… |
CVE-2021-47764 | Medium | 5.5 | 2026-01-15 | AbsoluteTelnet 11.24 contains a denial of service vulnerability that allows local attackers to crash the application by manipulating DialUp connection and lice… |
CVE-2021-47763 | High | 8.2 | 2026-01-15 | Aimeos 2021.10 LTS contains a SQL injection vulnerability in the json api 'sort' parameter that allows attackers to inject malicious database queries. Attacker… |
CVE-2021-47762 | High | 7.8 | 2026-01-15 | HTTPDebuggerPro 9.11 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system pri… |
CVE-2021-47761 | High | 7.8 | 2026-01-15 | MilleGPG5 5.7.2 contains a local privilege escalation vulnerability that allows authenticated users to modify service executable files in the MariaDB bin direc… |
CVE-2021-47759 | Medium | 6.2 | 2026-01-15 | MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerSh… |
CVE-2021-47758 | High | 8.8 | 2026-01-15 | Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious PHP plugins th… |
CVE-2021-47757 | High | 8.8 | 2026-01-15 | Chikitsa Patient Management System 2.0.2 contains an authenticated remote code execution vulnerability in the backup restoration functionality. Authenticated a… |
CVE-2021-47755 | High | 7.5 | 2026-01-15 | Oliver Library Server v5 contains a file download vulnerability that allows unauthenticated attackers to access arbitrary system files through unsanitized inpu… |
CVE-2021-47754 | Medium | 6.5 | 2026-01-15 | Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers ca… |
CVE-2021-47753 | Critical | 9.8 | 2026-01-15 | phpKF CMS 3.00 Beta y6 contains an unauthenticated file upload vulnerability that allows remote attackers to execute arbitrary code by bypassing file extension… |
CVE-2021-47752 | High | 7.5 | 2026-01-15 | AWebServer GhostBuilding 18 contains a denial of service vulnerability that allows remote attackers to overwhelm the server by sending multiple concurrent HTTP… |
CVE-2021-47751 | High | 7.5 | 2026-01-13 | CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers… |
CVE-2021-47750 | Medium | 6.1 | 2026-01-13 | YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the sign… |
CVE-2021-47749 | Medium | 5.5 | 2026-01-13 | YouPHPTube <= 7.8 contains a local file inclusion vulnerability that allows unauthenticated attackers to access arbitrary files by manipulating the 'lang' para… |
CVE-2021-41074 | Medium | 5.4 | 2026-01-12 | A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document. |
CVE-2021-47747 | High | 8.8 | 2025-12-31 | meterN 1.2.3 contains an authenticated remote code execution vulnerability in admin_meter2.php and admin_indicator2.php scripts. Attackers can exploit the 'COM… |
CVE-2021-47745 | High | 8.8 | 2025-12-31 | Cypress Solutions CTM-200 2.7.1 contains an authenticated command injection vulnerability in the firmware upgrade script that allows remote attackers to execut… |
CVE-2021-47744 | High | 7.5 | 2025-12-31 | Cypress Solutions CTM-200/CTM-ONE 1.3.6 contains hard-coded credentials vulnerability in Linux distribution that exposes root access. Attackers can exploit the… |
CVE-2021-47743 | Medium | 6.1 | 2025-12-31 | COMMAX Biometric Access Control System 1.0.0 contains an unauthenticated reflected cross-site scripting vulnerability in cookie parameters 'CMX_ADMIN_NM' and '… |
CVE-2021-47742 | High | 8.8 | 2025-12-31 | Epic Games Psyonix Rocket League <=1.95 contains an insecure permissions vulnerability that allows authenticated users to modify executable files with full acc… |
CVE-2021-47741 | High | 7.5 | 2025-12-31 | ZBL EPON ONU Broadband Router V100R001 contains a privilege escalation vulnerability that allows limited administrative users to elevate access by sending requ… |
CVE-2021-47740 | High | 7.5 | 2025-12-31 | KZTech JT3500V 4G LTE CPE 2.0.1 contains a session management vulnerability that allows attackers to reuse old session credentials without proper expiration. A… |
CVE-2021-47726 | High | 7.5 | 2025-12-31 | NuCom 11N Wireless Router 5.07.90 contains a privilege escalation vulnerability that allows non-privileged users to access administrative credentials through t… |
CVE-2021-47725 | Medium | 5.4 | 2025-12-31 | STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML… |
CVE-2021-47739 | High | 8.4 | 2025-12-23 | Epic Games Easy Anti-Cheat 4.0 contains an unquoted service path vulnerability that allows local non-privileged users to execute arbitrary code with elevated s… |
CVE-2021-47738 | Medium | 5.4 | 2025-12-23 | CSZ CMS 1.2.7 contains a persistent cross-site scripting vulnerability that allows unauthorized users to embed malicious JavaScript in private messages. Attack… |
CVE-2021-47737 | Medium | 5.4 | 2025-12-23 | CSZ CMS 1.2.7 contains an HTML injection vulnerability that allows authenticated users to insert malicious hyperlinks in message titles. Attackers can craft PO… |
CVE-2021-47736 | High | 7.2 | 2025-12-23 | CMSimple_XH 1.7.4 contains an authenticated remote code execution vulnerability in the content editing functionality that allows administrative users to upload… |
CVE-2021-47735 | High | 8.8 | 2025-12-23 | CMSimple 5.4 contains an authenticated remote code execution vulnerability that allows logged-in attackers to inject malicious PHP code into template files. At… |
CVE-2021-47734 | High | 7.8 | 2025-12-23 | CMSimple 5.4 contains an authenticated local file inclusion vulnerability that allows remote attackers to manipulate PHP session files and execute arbitrary co… |
CVE-2021-47733 | Medium | 6.1 | 2025-12-23 | CMSimple 5.4 contains a cross-site scripting vulnerability that allows attackers to bypass input filtering by using HTML to Unicode encoding. Attackers can inj… |
CVE-2021-47732 | Medium | 6.1 | 2025-12-23 | CMSimple 5.2 contains a stored cross-site scripting vulnerability in the Filebrowser External input field that allows attackers to inject malicious JavaScript… |
CVE-2021-47722 | Low | 3.5 | 2025-12-23 | Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings witho… |
CVE-2021-47721 | High | 8.8 | 2025-12-23 | Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating se… |
CVE-2021-47720 | High | 7.1 | 2025-12-23 | Orangescrum 1.8.0 contains an authenticated SQL injection vulnerability that allows authorized users to manipulate database queries through multiple vulnerable… |
CVE-2021-47716 | Medium | 5.4 | 2025-12-23 | Orangescrum 1.8.0 contains multiple cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts through various input p… |
CVE-2021-47715 | Medium | 5.3 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a server-side request forgery vulnerability that allows attackers to inject arbitrary remote schema URLs through the add_remote_s… |
CVE-2021-47714 | Medium | 5.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a local file read vulnerability that allows attackers to access system files through SQL injection in the query endpoint. Attacke… |
CVE-2021-47713 | High | 7.5 | 2025-12-22 | Hasura GraphQL 1.3.3 contains a denial of service vulnerability that allows attackers to overwhelm the service by crafting malicious GraphQL queries with exces… |
CVE-2021-47712 | High | 7.5 | 2025-12-18 | A cryptography vulnerability in Kentico Xperience allows attackers to potentially manipulate URL hash values through existing hashing mechanisms. The hotfix in… |
CVE-2021-47711 | High | 8.8 | 2025-12-18 | A SQL injection vulnerability in Kentico Xperience allows authenticated editors to inject malicious SQL queries via online marketing macro method parameters. T… |
CVE-2021-47731 | Critical | 9.8 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains a hard-coded developer password vulnerability that allows unauthorized configuration access through an undocumented pag… |
CVE-2021-47730 | High | 8.8 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains a cross-site request forgery vulnerability that allows attackers to create administrative users without authentication… |
CVE-2021-47729 | Medium | 5.4 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains a stored cross-site scripting vulnerability in the 'files_list' parameter that allows attackers to inject malicious HTM… |
CVE-2021-47728 | Critical | 9.8 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitrary shell… |
CVE-2021-47727 | Medium | 5.3 | 2025-12-09 | Selea Targa IP OCR-ANPR Camera contains an unauthenticated vulnerability that allows remote attackers to access live video streams without authentication. Atta… |
CVE-2021-47724 | Medium | 6.5 | 2025-12-09 | STVS ProVision 5.9.10 contains a path traversal vulnerability that allows authenticated attackers to access arbitrary files by manipulating the files parameter… |
CVE-2021-47723 | High | 8.8 | 2025-12-09 | STVS ProVision 5.9.10 contains a cross-site request forgery vulnerability that allows attackers to perform actions with administrative privileges by exploiting… |
CVE-2021-47719 | | 2025-12-09 | COMMAX WebViewer ActiveX Control 2.1.4.5 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by providing excessively long… | |
CVE-2021-47718 | High | 7.5 | 2025-12-09 | OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing f… |
CVE-2021-47717 | | 2025-12-09 | IntelliChoice eFORCE Software Suite 2.5.9 contains a username enumeration vulnerability that allows attackers to enumerate valid users by exploiting the 'ctl00… | |
CVE-2021-47710 | | 2025-12-09 | COMMAX Smart Home System is a smart IoT home solution that allows an unauthenticated attacker to disclose RTSP credentials in plain-text by exploiting the /ove… |