# CVEs published 2021-07-06

26 CVEs were published on July 6, 2021: 0 critical, 1 high. Days are UTC.

- [CVE-2021-22223](https://cve.now/CVE-2021-22223.md): Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT (CVSS 6.1, GitLab)
- [CVE-2021-22228](https://cve.now/CVE-2021-22228.md): An issue has been discovered in GitLab affecting all versions before 13.11.6, all versions starting from 13.12 before 13.12.6, and all versi (CVSS 6.5, GitLab)
- [CVE-2021-22226](https://cve.now/CVE-2021-22226.md): Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since versi (CVSS 6.5, GitLab)
- [CVE-2020-23697](https://cve.now/CVE-2020-23697.md): Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php. (no CVSS)
- [CVE-2021-22232](https://cve.now/CVE-2021-22232.md): HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE (CVSS 3.5, GitLab)
- [CVE-2021-22229](https://cve.now/CVE-2021-22229.md): An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. (CVSS 5.9, GitLab)
- [CVE-2020-22249](https://cve.now/CVE-2020-22249.md): Remote Code Execution vulnerability in phplist 3.5.1. (no CVSS)
- [CVE-2020-22251](https://cve.now/CVE-2020-22251.md): Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin. (no CVSS)
- [CVE-2021-34190](https://cve.now/CVE-2021-34190.md): A stored cross site scripting (XSS) vulnerability in index.php?menu=billing\_rates of Issabel PBX version 4 allows attackers to execute arbit (no CVSS)
- [CVE-2021-35440](https://cve.now/CVE-2021-35440.md): Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). (no CVSS, smashing)
- [CVE-2021-32740](https://cve.now/CVE-2021-32740.md): Regular Expression Denial of Service in Addressable templates (CVSS 7.5, sporkmonger addressable · addressable)
- [CVE-2021-27930](https://cve.now/CVE-2021-27930.md): Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated (or compromised) user to inject malicious Java (CVSS 5.4)
- [CVE-2021-32559](https://cve.now/CVE-2021-32559.md): An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that w (no CVSS, pywin32)
- [CVE-2021-24494](https://cve.now/CVE-2021-24494.md): WP Offload SES Lite \< 1.4.5 - Stored Cross-Site Scripting (XSS) (no CVSS, Delicious Brains WP Offload SES Lite)
- [CVE-2021-24451](https://cve.now/CVE-2021-24451.md): Export Users With Meta \< 0.6.5 - Authenticated SQL Injection (no CVSS, Export Users With Meta)
- [CVE-2021-24407](https://cve.now/CVE-2021-24407.md): Jannah \< 5.4.5 - Reflected Cross-Site Scripting (XSS) (no CVSS, TieLabs Jannah)
- [CVE-2021-24406](https://cve.now/CVE-2021-24406.md): wpForo Forum \< 1.9.7 - Open Redirect (no CVSS, gVectors Team wpForo Forum)
- [CVE-2021-24405](https://cve.now/CVE-2021-24405.md): Easy Cookie Policy \<= 1.6.2 - Broken Access Control to Stored Cross-Site Scripting (no CVSS, IZSoft Easy Cookies Policy)
- [CVE-2021-24389](https://cve.now/CVE-2021-24389.md): FoodBakery \< 2.2 - Reflected Cross-Site Scripting (XSS) (no CVSS, Chimpstudio WP Foodbakery · Chimpstudio FoodBakery)
- [CVE-2021-24387](https://cve.now/CVE-2021-24387.md): Real Estate 7 \< 3.1.1 - Reflected Cross-Site Scripting (XSS) (no CVSS, Contempoinc WP Pro Real Estate)
- [CVE-2021-24388](https://cve.now/CVE-2021-24388.md): Vik Rent Car \< 1.1.7 - CSRF to Stored XSS (no CVSS, E4J s.r.l. VikRentCar Car Rental Management System)
- [CVE-2021-24386](https://cve.now/CVE-2021-24386.md): WP SVG Images \< 3.4 - Authenticated (author+) Stored XSS via SVG (no CVSS, KubiQ WP SVG images)
- [CVE-2021-24384](https://cve.now/CVE-2021-24384.md): JoomSport \< 5.1.8 - Unauthenticated PHP Object Injection (no CVSS, JoomSport – for Sports: Team & League, Football, Hockey & m…)
- [CVE-2021-24375](https://cve.now/CVE-2021-24375.md): Motor theme \< 3.1.0 - Local File Inclusion (no CVSS, Stockware Motor)
- [CVE-2021-24005](https://cve.now/CVE-2021-24005.md): Usage of hard-coded cryptographic keys to encrypt configuration files and debug logs in FortiAuthenticator versions before 6.3.0 may allow a (CVSS 4.0, Fortinet FortiAuthenticator)
- [CVE-2021-3598](https://cve.now/CVE-2021-3598.md): There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. (no CVSS, OpenEXR)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2021-07-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.