# CVEs published 2022-03-20

13 CVEs were published on March 20, 2022: 0 critical, 0 high. Days are UTC.

- [CVE-2021-39384](https://cve.now/CVE-2021-39384.md): DWSurvey v3.2.0 was discovered to contain an arbitrary file write vulnerability via the component /utils/ToHtmlServlet.java. (no CVSS)
- [CVE-2021-42194](https://cve.now/CVE-2021-42194.md): The wechat\_return function in /controller/Index.php of EyouCms V1.5.4-UTF8-SP3 passes the user's input directly into the simplexml\_ load\_ St (no CVSS)
- [CVE-2021-39383](https://cve.now/CVE-2021-39383.md): DWSurvey v3.2.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /sysuser/SysPropertyAction.java. (no CVSS)
- [CVE-2020-26008](https://cve.now/CVE-2020-26008.md): The PluginsUpload function in application/service/PluginsAdminService.php of ShopXO v1.9.0 contains an arbitrary file upload vulnerability w (no CVSS)
- [CVE-2020-26007](https://cve.now/CVE-2020-26007.md): An arbitrary file upload vulnerability in the upload payment plugin of ShopXO v1.9.0 allows attackers to execute arbitrary code via uploadin (no CVSS)
- [CVE-2022-25462](https://cve.now/CVE-2022-25462.md): Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. (no CVSS)
- [CVE-2022-26555](https://cve.now/CVE-2022-26555.md): A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scri (no CVSS)
- [CVE-2022-26246](https://cve.now/CVE-2022-26246.md): TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate. (no CVSS)
- [CVE-2022-26247](https://cve.now/CVE-2022-26247.md): TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. (no CVSS)
- [CVE-2022-25464](https://cve.now/CVE-2022-25464.md): A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrar (no CVSS)
- [CVE-2021-44345](https://cve.now/CVE-2021-44345.md): Beijing Wisdom Vision Technology Industry Co., Ltd One Card Integrated Management System 3.0 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2022-24125](https://cve.now/CVE-2022-24125.md): The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push request (no CVSS)
- [CVE-2022-25481](https://cve.now/CVE-2022-25481.md): ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. (CVSS 4.0, topthink/framework)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2022-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.