CVE-2021-46386

https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: File Upload. The impact is: execute arbitrary code (remote). The component is: net.mingsoft.basic.action.web.FileAction#upload. The attack vector is: jspx webshell. ¶¶ MCMS has a file upload vulnerability through which attacker can upload a webshell. Successful attacks of this vulnerability can result in takeover of MCMS

Source: CVE-2021-46386

CVE-2021-46115

jpress 4.2.0 is vulnerable to RCE via io.jpress.web.admin._TemplateController#doUploadFile. The admin panel provides a function through which attackers can upload templates and inject some malicious code.

Source: CVE-2021-46115

CVE-2021-46116

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.web.admin._TemplateController#doInstall. The admin panel provides a function through which attackers can install templates and inject some malicious code.

Source: CVE-2021-46116

CVE-2021-46118

jpress 4.2.0 is vulnerable to remote code execution via io.jpress.module.article.kit.ArticleNotifyKit#doSendEmail. The admin panel provides a function through which attackers can edit the email templates and inject some malicious code.

Source: CVE-2021-46118

CVE-2021-46383

https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: SQL Injection. The impact is: obtain sensitive information (remote). The component is: net.mingsoft.mdiy.action.web.DictAction#list. The attack vector is: 0 or sleep(3). ¶¶ MCMS has a sql injection vulnerability through which attacker can get sensitive information from the database.

Source: CVE-2021-46383

CVE-2021-43334

BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.

Source: CVE-2021-43334

CVE-2021-44692

BuddyBoss Platform through 1.8.0 allows remote attackers to obtain the email address of each user. When creating a new user, it generates a Unique ID for their profile. This UID is their private email address with symbols removed and periods replaced with hyphens. For example. [email protected] would become /members/johndoeexample-com and [email protected] would become /members/jo-testexample-com. The members list is available to everyone and (in a default configuration) often without authentication. It is therefore trivial to collect a list of email addresses.

Source: CVE-2021-44692

CVE-2022-22851

A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital’s Patient Records Management System 1.0 via the specialization parameter in doctors.php

Source: CVE-2022-22851

CVE-2022-0378

Cross-site Scripting (XSS) – Reflected in Packagist microweber/microweber prior to 1.2.11.

Source: CVE-2022-0378

CVE-2022-0379

Cross-site Scripting (XSS) – Stored in Packagist microweber/microweber prior to 1.2.11.

Source: CVE-2022-0379