CVEs published March 20, 2022
13 CVEs were published on March 20, 2022: 0 critical, 0 high.
- Published
- 13
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 0
Most affected products
- topthink/framework
- 1
Medium, low and unrated 13
- CVE-2021-39384DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java.
- CVE-2021-42194The wechat_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml_ load_ St
- CVE-2021-39383DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java.
- CVE-2020-26008The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability w
- CVE-2020-26007An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploadin
- CVE-2022-25462Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c.
- CVE-2022-26555A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scri
- CVE-2022-26246TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate.
- CVE-2022-26247TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2.
- CVE-2022-25464A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrar
- CVE-2021-44345Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection.
- CVE-2022-24125The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push request
- CVE-2022-25481ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter.topthink/framework