# CVEs published 2021-04-05

65 CVEs were published on April 5, 2021: 0 critical, 0 high. Days are UTC.

- [CVE-2021-30141](https://cve.now/CVE-2021-30141.md): Module/Settings/UserExport.php in Friendica through 2021.01 allows settings/userexport to be used by anonymous users, as demonstrated by an (no CVSS)
- [CVE-2021-20307](https://cve.now/CVE-2021-20307.md): Format string vulnerability in panoFileOutputNamesCreate() in libpano13 2.9.20~rc2+dfsg-3 and earlier can lead to read and write arbitrary m (no CVSS, libpano13)
- [CVE-2021-20308](https://cve.now/CVE-2021-20308.md): Integer overflow in the htmldoc 1.9.11 and before may allow attackers to execute arbitrary code and cause a denial of service that is simila (no CVSS, htmldoc)
- [CVE-2021-20305](https://cve.now/CVE-2021-20305.md): A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result (no CVSS, nettle)
- [CVE-2020-19595](https://cve.now/CVE-2020-19595.md): Buffer overflow vulnerability in Core FTP Server v2 Build 697, via a crafted username. (no CVSS)
- [CVE-2020-19596](https://cve.now/CVE-2020-19596.md): Buffer overflow vulnerability in Core FTP Server v1.2 Build 583, via a crafted username. (no CVSS)
- [CVE-2021-24210](https://cve.now/CVE-2021-24210.md): PhastPress \< 1.111 - Open Redirect (no CVSS, PhastPress)
- [CVE-2021-24211](https://cve.now/CVE-2021-24211.md): WordPress Related Posts \<= 3.6.4 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, WordPress Related Posts)
- [CVE-2021-24212](https://cve.now/CVE-2021-24212.md): WooCommerce Help Scout \< 2.9.1 - Unauthenticated Arbitrary File Upload leading to RCE (no CVSS, WooCommerce Help Scout)
- [CVE-2021-24201](https://cve.now/CVE-2021-24201.md): Elementor \< 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Column Element (no CVSS, Elementor Website Builder)
- [CVE-2021-24202](https://cve.now/CVE-2021-24202.md): Elementor \< 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Heading Widget (no CVSS, Elementor Website Builder)
- [CVE-2021-24203](https://cve.now/CVE-2021-24203.md): Elementor \< 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Divider Widget (no CVSS, Elementor Website Builder)
- [CVE-2021-24204](https://cve.now/CVE-2021-24204.md): Elementor \< 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Accordion Widget (no CVSS, Elementor Website Builder)
- [CVE-2021-24205](https://cve.now/CVE-2021-24205.md): Elementor \< 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Icon Box Widget (no CVSS, Elementor Website Builder)
- [CVE-2021-24206](https://cve.now/CVE-2021-24206.md): Elementor \< 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) in Image Box Widget (no CVSS, Elementor Website Builder)
- [CVE-2021-24207](https://cve.now/CVE-2021-24207.md): WP Page Builder \< 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts (no CVSS, WP Page Builder)
- [CVE-2021-24208](https://cve.now/CVE-2021-24208.md): WP Page Builder \< 1.2.4 - Multiple Stored Cross-Site scripting (XSS) (no CVSS, WP Page Builder)
- [CVE-2021-24209](https://cve.now/CVE-2021-24209.md): WP Super Cache \< 1.7.2 - Authenticated Remote Code Execution (RCE) (no CVSS, WP Super Cache)
- [CVE-2021-24177](https://cve.now/CVE-2021-24177.md): WP File Manager \< 7.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, File Manager)
- [CVE-2021-24180](https://cve.now/CVE-2021-24180.md): Related Posts for WordPress \< 2.0.4 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Related Posts for WordPress)
- [CVE-2021-24181](https://cve.now/CVE-2021-24181.md): Tutor LMS \< 1.7.7 - SQL Injection via tutor\_mark\_answer\_as\_correct (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24182](https://cve.now/CVE-2021-24182.md): Tutor LMS \< 1.8.3 - SQL Injection via tutor\_quiz\_builder\_get\_answers\_by\_question (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24183](https://cve.now/CVE-2021-24183.md): Tutor LMS \< 1.8.3 - SQL Injection via tutor\_quiz\_builder\_get\_question\_form (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24184](https://cve.now/CVE-2021-24184.md): Tutor LMS \< 1.7.7 - Unprotected AJAX including Privilege Escalation (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24185](https://cve.now/CVE-2021-24185.md): Tutor LMS \< 1.7.7 - SQL Injection via tutor\_place\_rating (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24186](https://cve.now/CVE-2021-24186.md): Tutor LMS \< 1.8.3 - SQL Injection via tutor\_answering\_quiz\_question/get\_answer\_by\_id (no CVSS, Tutor LMS – eLearning and online course solution)
- [CVE-2021-24187](https://cve.now/CVE-2021-24187.md): SEO Redirection \< 6.4 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, SEO Redirection Plugin - 301 Redirect Manager)
- [CVE-2021-24196](https://cve.now/CVE-2021-24196.md): Social Slider Widget \< 1.8.5 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Social Slider Widget)
- [CVE-2021-24168](https://cve.now/CVE-2021-24168.md): Easy Contact Form Pro \< 1.1.1.9 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Easy Contact Form Pro)
- [CVE-2021-24169](https://cve.now/CVE-2021-24169.md): Advanced Order Export For WooCommerce \< 3.1.8 - Reflected Cross-Site Scripting (XSS) (no CVSS, Advanced Order Export For WooCommerce)
- [CVE-2021-24170](https://cve.now/CVE-2021-24170.md): User Profile Picture \< 2.5.0 - Sensitive Information Disclosure (no CVSS, User Profile Picture)
- [CVE-2021-24171](https://cve.now/CVE-2021-24171.md): WooCommerce Upload Files \< 59.4 - Unauthenticated Arbitrary File Upload (no CVSS, WooCommerce Upload Files)
- [CVE-2021-24172](https://cve.now/CVE-2021-24172.md): VM Backups \<= 1.0 - CSRF to Database Backup Download (no CVSS, VM Backups)
- [CVE-2021-24173](https://cve.now/CVE-2021-24173.md): VM Backups \<= 1.0 - CSRF to Stored Cross-Site Scripting (XSS) (no CVSS, VM Backups)
- [CVE-2021-24174](https://cve.now/CVE-2021-24174.md): Database Backups \<= 1.2.2.6 - CSRF to Backup Download (no CVSS, Database Backups)
- [CVE-2021-24175](https://cve.now/CVE-2021-24175.md): The Plus Addons for Elementor Page Builder \< 4.1.7 - Authentication Bypass (no CVSS, The Plus Addons for Elementor Page Builder)
- [CVE-2021-24176](https://cve.now/CVE-2021-24176.md): JH 404 Logger \<= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) (no CVSS, JH 404 Logger)
- [CVE-2021-24159](https://cve.now/CVE-2021-24159.md): Contact Form 7 Style \<= 3.1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting (no CVSS, Contact Form 7 Style)
- [CVE-2021-24160](https://cve.now/CVE-2021-24160.md): Responsive Menu 4.0.0 - 4.0.3 - Authenticated Arbitrary File Upload (no CVSS, ExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…)
- [CVE-2021-24161](https://cve.now/CVE-2021-24161.md): Responsive Menu \< 4.0.4 - CSRF to Arbitrary File Upload (no CVSS, ExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…)
- [CVE-2021-24162](https://cve.now/CVE-2021-24162.md): Responsive Menu \< 4.0.4 - CSRF to Settings Update (no CVSS, ExpressTech Responsive Menu – Create Mobile-Friendly Menu ·…)
- [CVE-2021-24163](https://cve.now/CVE-2021-24163.md): Ninja Forms \< 3.4.34 - Authenticated SendWP Plugin Installation and Client Secret Key Disclosure (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-24164](https://cve.now/CVE-2021-24164.md): Ninja Forms \< 3.4.34.1 - Authenticated OAuth Connection Key Disclosure (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-24165](https://cve.now/CVE-2021-24165.md): Ninja Forms \< 3.4.34 - Administrator Open Redirect (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-24166](https://cve.now/CVE-2021-24166.md): Ninja Forms \< 3.4.34 - CSRF to OAuth Service Disconnection (no CVSS, Ninja Forms Contact Form – The Drag and Drop Form Builder f…)
- [CVE-2021-24167](https://cve.now/CVE-2021-24167.md): Web-Stat \< 1.4.1 - API Key Disclosure (no CVSS, Web-Stat)
- [CVE-2021-24150](https://cve.now/CVE-2021-24150.md): Like Button Rating \< 2.6.32 - Unauthenticated Full-Read SSRF (no CVSS, Like Button Rating ♥ LikeBtn)
- [CVE-2021-24152](https://cve.now/CVE-2021-24152.md): Popup Builder \< 3.74 - Authenticated Reflected Cross-Site Scripting (XSS) (no CVSS, Popup Builder – Responsive WordPress Pop up – Subscription…)
- [CVE-2021-24153](https://cve.now/CVE-2021-24153.md): Yoast SEO \< 3.4.1 - Authenticated Stored Cross-Site Scripting (XSS) (no CVSS, Yoast SEO)
- [CVE-2021-24154](https://cve.now/CVE-2021-24154.md): Theme Editor \< 2.6 - Authenticated Arbitrary File Download (no CVSS, Theme Editor)
- [CVE-2021-24155](https://cve.now/CVE-2021-24155.md): Backup Guard \< 1.6.0 - Authenticated Arbitrary File Upload (no CVSS, WordPress Backup and Migrate Plugin – Backup Guard)
- [CVE-2021-24156](https://cve.now/CVE-2021-24156.md): Testimonial Rotator \<= 3.0.3 - Authenticated Stored Cross-Site Scripting (no CVSS, Testimonial Rotator)
- [CVE-2021-24157](https://cve.now/CVE-2021-24157.md): Orbit Fox by ThemeIsle \< 2.10.3 - Authenticated Stored Cross Site Scripting (no CVSS, Orbit Fox by ThemeIsle)
- [CVE-2021-24158](https://cve.now/CVE-2021-24158.md): Orbit Fox by ThemeIsle \< 2.10.3 - Authenticated Privilege Escalation (no CVSS, Orbit Fox by ThemeIsle)
- [CVE-2020-4997](https://cve.now/CVE-2020-4997.md): IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2020-4792](https://cve.now/CVE-2020-4792.md): IBM Edge 4.2 is vulnerable to cross-site scripting. (CVSS 5.4, IBM Edge)
- [CVE-2021-30109](https://cve.now/CVE-2021-30109.md): Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). (no CVSS, froala-editor)
- [CVE-2021-30055](https://cve.now/CVE-2021-30055.md): A SQL injection vulnerability in Knowage Suite version 7.1 exists in the documentexecution/url analytics driver component via the 'par\_year' (no CVSS)
- [CVE-2021-30056](https://cve.now/CVE-2021-30056.md): Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting (XSS). (no CVSS)
- [CVE-2021-30057](https://cve.now/CVE-2021-30057.md): A stored HTML injection vulnerability exists in Knowage Suite version 7.1. (no CVSS)
- [CVE-2021-30058](https://cve.now/CVE-2021-30058.md): Knowage Suite before 7.4 is vulnerable to cross-site scripting (XSS). (no CVSS)
- [CVE-2021-29996](https://cve.now/CVE-2021-29996.md): Mark Text through 0.16.3 allows attackers arbitrary command execution. (no CVSS)
- [CVE-2021-29261](https://cve.now/CVE-2021-29261.md): The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace con (no CVSS)
- [CVE-2021-28832](https://cve.now/CVE-2021-28832.md): VSCodeVim before 1.19.0 allows attackers to execute arbitrary code via a crafted workspace configuration. (no CVSS)
- [CVE-2020-17453](https://cve.now/CVE-2020-17453.md): WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-04-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.