# Vulnerabilities published in 2021


- [CVE-2021-25159](https://insights.sbomify.com/CVE-2021-25159/): Other in Aruba Instant Access Points (medium 6.5)
- [CVE-2021-25158](https://insights.sbomify.com/CVE-2021-25158/): Race condition in Aruba Instant Access Points (medium 5.9)
- [CVE-2021-25157](https://insights.sbomify.com/CVE-2021-25157/): Path traversal in Aruba Instant Access Points (medium 4.9)
- [CVE-2021-25156](https://insights.sbomify.com/CVE-2021-25156/): Path traversal in Aruba Instant Access Points (medium 4.9)
- [CVE-2021-25155](https://insights.sbomify.com/CVE-2021-25155/): Other in Aruba Instant Access Points (medium 6.5)
- [CVE-2021-25154](https://insights.sbomify.com/CVE-2021-25154/): Privilege escalation in Aruba AirWave Management Platform (high 7.5)
- [CVE-2021-25153](https://insights.sbomify.com/CVE-2021-25153/): SQL injection in Aruba AirWave Management Platform (high 8.1)
- [CVE-2021-25152](https://insights.sbomify.com/CVE-2021-25152/): Deserialization in Aruba AirWave Management Platform (high 7.2)
- [CVE-2021-25151](https://insights.sbomify.com/CVE-2021-25151/): Deserialization in Aruba AirWave Management Platform (high 8.8)
- [CVE-2021-25150](https://insights.sbomify.com/CVE-2021-25150/): Command injection in Aruba Instant Access Points (high 8.8)
- [CVE-2021-25149](https://insights.sbomify.com/CVE-2021-25149/): Memory corruption in Aruba Instant Access Points (critical 9.8)
- [CVE-2021-25148](https://insights.sbomify.com/CVE-2021-25148/): Other in Aruba Instant Access Points (high 8.1)
- [CVE-2021-25147](https://insights.sbomify.com/CVE-2021-25147/): Auth bypass in Aruba AirWave Management Platform (high 8.1)
- [CVE-2021-25146](https://insights.sbomify.com/CVE-2021-25146/): Command injection in Aruba Instant Access Points (high 7.2)
- [CVE-2021-25145](https://insights.sbomify.com/CVE-2021-25145/): Information disclosure in Aruba Instant Access Points (medium 6.5)
- [CVE-2021-25144](https://insights.sbomify.com/CVE-2021-25144/): Memory corruption in Aruba Instant Access Points (high 8.8)
- [CVE-2021-25143](https://insights.sbomify.com/CVE-2021-25143/): Denial of service in Aruba Instant Access Points (high 7.5)
- [CVE-2021-25142](https://insights.sbomify.com/CVE-2021-25142/): Memory corruption in HPE Apollo 70 System (high 7.8)
- [CVE-2021-25141](https://insights.sbomify.com/CVE-2021-25141/): Denial of service in Aruba 5400R zl2 Switch Series; Aruba 2930F Switch Series; Aruba 2920 Switch Series; Aruba 2930M Switch Series; Aruba 2530 Switch Series; Aruba 2540 Switch Series; Aruba 3800 Switch Series; HPE 3500 and 3500 yl Switch Series; Aruba 3810M Switch Series; HPE 8200 zl Switch Series; Aruba 2620 Switch Series; Aruba 5400 zl Switch Series; HPE 6200 yl Switch Series (medium 4.4)
- [CVE-2021-25140](https://insights.sbomify.com/CVE-2021-25140/): Path traversal in HPE Moonshot Provisioning Manager (critical 9.8)
- [CVE-2021-25139](https://insights.sbomify.com/CVE-2021-25139/): Memory corruption in HPE Moonshot Provisioning Manager (critical 9.8)
- [CVE-2021-25138](https://insights.sbomify.com/CVE-2021-25138/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25137](https://insights.sbomify.com/CVE-2021-25137/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25136](https://insights.sbomify.com/CVE-2021-25136/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25135](https://insights.sbomify.com/CVE-2021-25135/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25134](https://insights.sbomify.com/CVE-2021-25134/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25133](https://insights.sbomify.com/CVE-2021-25133/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25132](https://insights.sbomify.com/CVE-2021-25132/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25131](https://insights.sbomify.com/CVE-2021-25131/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25130](https://insights.sbomify.com/CVE-2021-25130/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25129](https://insights.sbomify.com/CVE-2021-25129/): Path traversal in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25128](https://insights.sbomify.com/CVE-2021-25128/): Path traversal in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25127](https://insights.sbomify.com/CVE-2021-25127/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25126](https://insights.sbomify.com/CVE-2021-25126/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25125](https://insights.sbomify.com/CVE-2021-25125/): Path traversal in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25124](https://insights.sbomify.com/CVE-2021-25124/): Path traversal in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25123](https://insights.sbomify.com/CVE-2021-25123/): Memory corruption in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server (high 7.8)
- [CVE-2021-25122](https://insights.sbomify.com/CVE-2021-25122/): Apache Tomcat h2c request mix-up (high 7.5)
- [CVE-2021-25121](https://insights.sbomify.com/CVE-2021-25121/): Rating by BestWebSoft < 1.6 - Rating Denial of Service (medium 6.5)
- [CVE-2021-25120](https://insights.sbomify.com/CVE-2021-25120/): Easy Social Feed < 6.2.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25119](https://insights.sbomify.com/CVE-2021-25119/): AGIL <= 1.0 - Admin+ Arbitrary File Upload (high 7.2)
- [CVE-2021-25118](https://insights.sbomify.com/CVE-2021-25118/): Yoast SEO 16.7-17.2 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2021-25117](https://insights.sbomify.com/CVE-2021-25117/): WP Postratings < 1.86.1 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25116](https://insights.sbomify.com/CVE-2021-25116/): Enqueue Anything <= 1.0.1 - Subscriber+ Arbitrary Asset/Post Deletion (medium 6.5)
- [CVE-2021-25115](https://insights.sbomify.com/CVE-2021-25115/): WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS) (medium 6.4)
- [CVE-2021-25114](https://insights.sbomify.com/CVE-2021-25114/): Paid Memberships Pro < 2.6.7 - Unauthenticated Blind SQL Injection (critical 9.8)
- [CVE-2021-25113](https://insights.sbomify.com/CVE-2021-25113/): Dropdown Menu Widget <= 1.9.7 - Subscriber+ Arbitrary Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-25112](https://insights.sbomify.com/CVE-2021-25112/): WHMCS Bridge < 6.4b - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-25111](https://insights.sbomify.com/CVE-2021-25111/): English WordPress Admin < 1.5.2 - Unauthenticated Open Redirect (medium 6.1)
- [CVE-2021-25110](https://insights.sbomify.com/CVE-2021-25110/): Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure (medium 4.3)
- [CVE-2021-25109](https://insights.sbomify.com/CVE-2021-25109/): Futurio Extra < 1.6.3 - Authenticated SQL Injection (low 2.7)
- [CVE-2021-25108](https://insights.sbomify.com/CVE-2021-25108/): IP2Location Country Blocker < 2.26.6 - Arbitrary Country Ban via CSRF (high 7.1)
- [CVE-2021-25107](https://insights.sbomify.com/CVE-2021-25107/): Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-25106](https://insights.sbomify.com/CVE-2021-25106/): WPLegalPages < 2.7.1 - Subscriber+ Arbitrary Settings Update to Stored XSS (medium 5.4)
- [CVE-2021-25105](https://insights.sbomify.com/CVE-2021-25105/): Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25104](https://insights.sbomify.com/CVE-2021-25104/): Ocean Extra < 1.9.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25103](https://insights.sbomify.com/CVE-2021-25103/): GTranslate < 2.9.7 - Reflected Cross-Site Scripting (medium 4.7)
- [CVE-2021-25102](https://insights.sbomify.com/CVE-2021-25102/): All In One WP Security < 4.4.11 - Authenticated Reflected Cross-Site Scripting (medium 4.7)
- [CVE-2021-25101](https://insights.sbomify.com/CVE-2021-25101/): Anti-Malware Security and Brute-Force Firewall < 4.20.94 - Admin+ Reflected Cross-Site Scripting (medium 4.8)
- [CVE-2021-25100](https://insights.sbomify.com/CVE-2021-25100/): Give < 2.17.3 - Reflected Cross-Site Scripting via Donation Forms Dashboard (medium 6.1)
- [CVE-2021-25099](https://insights.sbomify.com/CVE-2021-25099/): Give < 2.17.3 - Unauthenticated Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25098](https://insights.sbomify.com/CVE-2021-25098/): Easy Pricing Tables < 3.1.3 - Arbitrary Post Removal via CSRF (medium 6.5)
- [CVE-2021-25097](https://insights.sbomify.com/CVE-2021-25097/): LabTools <= 1.0 - Subscriber+ Arbitrary Publication Deletion (medium 6.5)
- [CVE-2021-25096](https://insights.sbomify.com/CVE-2021-25096/): IP2Location Country Blocker < 2.26.5 - Ban Bypass (medium 6.5)
- [CVE-2021-25095](https://insights.sbomify.com/CVE-2021-25095/): IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban (high 7.1)
- [CVE-2021-25094](https://insights.sbomify.com/CVE-2021-25094/): Tatsu < 3.3.12 - Unauthenticated RCE (high 8.1)
- [CVE-2021-25093](https://insights.sbomify.com/CVE-2021-25093/): Link Library < 7.2.8 - Unauthenticated Arbitrary Links Deletion (high 7.5)
- [CVE-2021-25092](https://insights.sbomify.com/CVE-2021-25092/): Link Library < 7.2.8 - Library Settings Reset via CSRF (medium 6.5)
- [CVE-2021-25091](https://insights.sbomify.com/CVE-2021-25091/): Link Library < 7.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25090](https://insights.sbomify.com/CVE-2021-25090/): GridKit Portfolio < 2.1.0 - Subscriber+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2021-25089](https://insights.sbomify.com/CVE-2021-25089/): UpdraftPlus < 1.16.69 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25088](https://insights.sbomify.com/CVE-2021-25088/): Google XML Sitemaps < 4.1.3 - Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2021-25087](https://insights.sbomify.com/CVE-2021-25087/): Wordpress Download Manager < 3.2.25 - Sensitive Information Disclosure (high 7.5)
- [CVE-2021-25086](https://insights.sbomify.com/CVE-2021-25086/): Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-25085](https://insights.sbomify.com/CVE-2021-25085/): WOOF - Products Filter for WooCommerce < 1.2.6.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25084](https://insights.sbomify.com/CVE-2021-25084/): Advanced Cron Manager - Subscriber+ Arbitrary Events/Schedules Creation/Deletion (medium 4.3)
- [CVE-2021-25083](https://insights.sbomify.com/CVE-2021-25083/): Registrations for the Events Calendar < 2.7.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25082](https://insights.sbomify.com/CVE-2021-25082/): Popup Builder < 4.0.7 - LFI to RCE (high 8.8)
- [CVE-2021-25081](https://insights.sbomify.com/CVE-2021-25081/): WP Google Map < 1.8.4 - Arbitrary Post Deletion and Plugin's Settings Update via CSRF (medium 6.5)
- [CVE-2021-25080](https://insights.sbomify.com/CVE-2021-25080/): Contact Form Entries < 1.1.7 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-25079](https://insights.sbomify.com/CVE-2021-25079/): Contact Form Entries < 1.2.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25078](https://insights.sbomify.com/CVE-2021-25078/): Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2021-25077](https://insights.sbomify.com/CVE-2021-25077/): Store Toolkit for WooCommerce < 2.3.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25076](https://insights.sbomify.com/CVE-2021-25076/): WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting (high 8.8)
- [CVE-2021-25075](https://insights.sbomify.com/CVE-2021-25075/): Duplicate Page or Post < 1.5.1 - Arbitrary Settings Update to Stored XSS (low 3.5)
- [CVE-2021-25074](https://insights.sbomify.com/CVE-2021-25074/): WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect (medium 6.1)
- [CVE-2021-25073](https://insights.sbomify.com/CVE-2021-25073/): WP125 < 1.5.5 - Arbitrary Ad Deletion via CSRF (high 8.8)
- [CVE-2021-25072](https://insights.sbomify.com/CVE-2021-25072/): NextScripts: Social Networks Auto-Poster < 4.3.25 - Arbitrary Post Deletion via CSRF (medium 6.5)
- [CVE-2021-25071](https://insights.sbomify.com/CVE-2021-25071/): Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25070](https://insights.sbomify.com/CVE-2021-25070/): WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi (critical 9.8)
- [CVE-2021-25069](https://insights.sbomify.com/CVE-2021-25069/): WordPress Download Manager < 3.2.34 - Authenticated SQL Injection to Reflected XSS (high 8.8)
- [CVE-2021-25068](https://insights.sbomify.com/CVE-2021-25068/): Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLi (high 7.2)
- [CVE-2021-25067](https://insights.sbomify.com/CVE-2021-25067/): Landing Page Builder < 1.4.9.6 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-25066](https://insights.sbomify.com/CVE-2021-25066/): Ninja Forms < 3.6.10 - Admin+ Stored Cross-Site Scripting via Import (medium 4.8)
- [CVE-2021-25065](https://insights.sbomify.com/CVE-2021-25065/): Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-25064](https://insights.sbomify.com/CVE-2021-25064/): Wow Countdowns <= 3.1.2 - Admin+ SQLi (high 7.2)
- [CVE-2021-25063](https://insights.sbomify.com/CVE-2021-25063/): Contact Form 7 Skins < 2.5.1 - Reflected Cross-Site Scripting (XSS) (medium 6.1)
- [CVE-2021-25062](https://insights.sbomify.com/CVE-2021-25062/): Orders Tracking for WooCommerce < 1.1.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-25061](https://insights.sbomify.com/CVE-2021-25061/): WP Booking System – Booking Calendar < 2.0.15 - Authenticated Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2021-25060](https://insights.sbomify.com/CVE-2021-25060/): Five Star Business Profile and Schema < 2.1.7 - Subscriber+ Page Creation & Settings Update to Stored XSS (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/206/