# CVEs published 2021-02-21

5 CVEs were published on February 21, 2021: 0 critical, 0 high. Days are UTC.

- [CVE-2021-27516](https://cve.now/CVE-2021-27516.md): URI.js (aka urijs) before 1.19.6 mishandles certain uses of backslash such as http:\\/ and interprets the URI as a relative path. (no CVSS, urijs)
- [CVE-2021-27513](https://cve.now/CVE-2021-27513.md): The module admin\_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le (no CVSS)
- [CVE-2021-27514](https://cve.now/CVE-2021-27514.md): EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for brute-force authentication (no CVSS)
- [CVE-2021-26716](https://cve.now/CVE-2021-26716.md): Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter. (no CVSS)
- [CVE-2021-27515](https://cve.now/CVE-2021-27515.md): url-parse before 1.5.0 mishandles certain uses of backslash such as http:\\/ and interprets the URI as a relative path. (no CVSS, url-parse)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.