CVEs published March 20, 2022
13 CVEs were published on March 20, 2022: 0 critical, 0 high. Browse them by severity, product and exploitation status.
- Published
- 13
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- topthink/framework
- 1
Medium, low and unrated 13
- CVE-2021-39384DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.
- CVE-2021-42194The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_…
- CVE-2021-39383DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java.
- CVE-2020-26008The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability…
- CVE-2020-26007An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via…
- CVE-2022-25462Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c.
- CVE-2022-26555A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web…
- CVE-2022-26246TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate.
- CVE-2022-26247TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2.
- CVE-2022-25464A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute…
- CVE-2021-44345Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.
- CVE-2022-24125The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push…
- CVE-2022-25481ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.topthink/framework