# Vulnerabilities published in 2021


- [CVE-2021-43737](https://insights.sbomify.com/CVE-2021-43737/): Cross-site request forgery in xiaohuanxiong project:xiaohuanxiong cms (medium 6.5)
- [CVE-2021-43736](https://insights.sbomify.com/CVE-2021-43736/): Command injection in cmswing:cmswing (critical 9.8)
- [CVE-2021-43735](https://insights.sbomify.com/CVE-2021-43735/): SQL injection in cmswing:cmswing (critical 9.8)
- [CVE-2021-43734](https://insights.sbomify.com/CVE-2021-43734/): Path traversal in keking:kkfileview (high 7.5)
- [CVE-2021-4373](https://insights.sbomify.com/CVE-2021-4373/): Better Search <= 2.5.2 - Cross-Site Request Forgery to Settings Import (high 8.8)
- [CVE-2021-43729](https://insights.sbomify.com/CVE-2021-43729/): Cross-site scripting in pix-link:lv-wr09 firmware (medium 5.4)
- [CVE-2021-43728](https://insights.sbomify.com/CVE-2021-43728/): Cross-site scripting in pix-link:lv-wr09 firmware (medium 5.4)
- [CVE-2021-43725](https://insights.sbomify.com/CVE-2021-43725/): Cross-site scripting in spotweb project:spotweb (medium 6.1)
- [CVE-2021-43724](https://insights.sbomify.com/CVE-2021-43724/): Cross-site scripting in intelliants:subrion cms (medium 4.8)
- [CVE-2021-43722](https://insights.sbomify.com/CVE-2021-43722/): Memory corruption in dlink:dir-645 firmware (critical 9.8)
- [CVE-2021-43721](https://insights.sbomify.com/CVE-2021-43721/): Cross-site scripting in leanote:leanote (medium 6.1)
- [CVE-2021-4372](https://insights.sbomify.com/CVE-2021-4372/): WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site Scripting (medium 6.5)
- [CVE-2021-43718](https://insights.sbomify.com/CVE-2021-43718/): An Authentication Bypass vulnerability exists in EPSON EH-TW5350 EPSON 150075647YWWV110, which could let a remote malicious user cause a Den (medium 5.3)
- [CVE-2021-43717](https://insights.sbomify.com/CVE-2021-43717/): An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. (critical 9.8)
- [CVE-2021-43716](https://insights.sbomify.com/CVE-2021-43716/): Verification Bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. (critical 9.8)
- [CVE-2021-43712](https://insights.sbomify.com/CVE-2021-43712/): Cross-site scripting in employee daily task management system project:employee daily task management system (medium 5.4)
- [CVE-2021-43711](https://insights.sbomify.com/CVE-2021-43711/): Command injection in totolink:ex200 firmware (critical 9.8)
- [CVE-2021-4371](https://insights.sbomify.com/CVE-2021-4371/): WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Change (medium 4.3)
- [CVE-2021-43708](https://insights.sbomify.com/CVE-2021-43708/): Security feature bypass in helpsystems:titus data classification (medium 5.5)
- [CVE-2021-43707](https://insights.sbomify.com/CVE-2021-43707/): Cross-site scripting in maccms:maccms (medium 6.1)
- [CVE-2021-43703](https://insights.sbomify.com/CVE-2021-43703/): Auth bypass in zzcms:zzcms (critical 9.8)
- [CVE-2021-43702](https://insights.sbomify.com/CVE-2021-43702/): Cross-site scripting in asus:4g-ac53u firmware (critical 9.0)
- [CVE-2021-43701](https://insights.sbomify.com/CVE-2021-43701/): SQL injection in cszcms:csz cms (medium 6.5)
- [CVE-2021-43700](https://insights.sbomify.com/CVE-2021-43700/): SQL injection in apimanager project:apimanager (critical 9.8)
- [CVE-2021-4370](https://insights.sbomify.com/CVE-2021-4370/): uListing <= 1.6.6 - Missing Authorization (critical 9.8)
- [CVE-2021-43698](https://insights.sbomify.com/CVE-2021-43698/): Cross-site scripting in phpwhois project:phpwhois (medium 6.1)
- [CVE-2021-43697](https://insights.sbomify.com/CVE-2021-43697/): Cross-site scripting in workerman-thinkphp-redis project:workerman-thinkphp-redis (medium 6.1)
- [CVE-2021-43696](https://insights.sbomify.com/CVE-2021-43696/): Cross-site scripting in twmap project:twmap (medium 6.1)
- [CVE-2021-43695](https://insights.sbomify.com/CVE-2021-43695/): Cross-site scripting in issabel:pbx (medium 6.1)
- [CVE-2021-43693](https://insights.sbomify.com/CVE-2021-43693/): Path traversal in vestacp:vesta control panel (critical 9.8)
- [CVE-2021-43692](https://insights.sbomify.com/CVE-2021-43692/): Cross-site scripting in youtube-php-mirroring project:youtube-php-mirroring (medium 6.1)
- [CVE-2021-43691](https://insights.sbomify.com/CVE-2021-43691/): Path traversal in tripexpress project:tripexpress (critical 9.8)
- [CVE-2021-43690](https://insights.sbomify.com/CVE-2021-43690/): Cross-site scripting in yurunproxy project:yurunproxy (medium 6.1)
- [CVE-2021-4369](https://insights.sbomify.com/CVE-2021-4369/): Frontend File Manager <= 18.2 - Unauthenticated Content Injection (medium 5.8)
- [CVE-2021-43689](https://insights.sbomify.com/CVE-2021-43689/): Cross-site scripting in manage project:manage (medium 6.1)
- [CVE-2021-43687](https://insights.sbomify.com/CVE-2021-43687/): Cross-site scripting in chamilo:chamilo (medium 6.1)
- [CVE-2021-43686](https://insights.sbomify.com/CVE-2021-43686/): Cross-site scripting in nzedb project:nzedb (medium 6.1)
- [CVE-2021-43685](https://insights.sbomify.com/CVE-2021-43685/): Path traversal in libretime:libretime hv (critical 9.8)
- [CVE-2021-43683](https://insights.sbomify.com/CVE-2021-43683/): Cross-site scripting in haschek:pictshare (medium 6.1)
- [CVE-2021-43682](https://insights.sbomify.com/CVE-2021-43682/): Cross-site scripting in thinkphp-bjyblog project:thinkphp-bjyblog (medium 6.1)
- [CVE-2021-43681](https://insights.sbomify.com/CVE-2021-43681/): Cross-site scripting in zerodream:sakurapanel (medium 6.1)
- [CVE-2021-4368](https://insights.sbomify.com/CVE-2021-4368/): Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Upload (critical 9.9)
- [CVE-2021-43679](https://insights.sbomify.com/CVE-2021-43679/): SQL injection in shopex:ecshop (critical 9.8)
- [CVE-2021-43678](https://insights.sbomify.com/CVE-2021-43678/): Wechat-php-sdk is affected by a Cross Site Scripting vulnerability. (medium 6.1)
- [CVE-2021-43677](https://insights.sbomify.com/CVE-2021-43677/): Cross-site scripting in fluxbb:fluxbb (medium 6.1)
- [CVE-2021-43676](https://insights.sbomify.com/CVE-2021-43676/): Path manipulation in matyhtf/framework (critical 9.8)
- [CVE-2021-43675](https://insights.sbomify.com/CVE-2021-43675/): Cross-site scripting in lycheeorg:lychee (medium 6.1)
- [CVE-2021-43674](https://insights.sbomify.com/CVE-2021-43674/): Path traversal in thinkupapp:thinkup (critical 9.8)
- [CVE-2021-43673](https://insights.sbomify.com/CVE-2021-43673/): Cross-site scripting in dzzoffice:dzzoffice (medium 6.1)
- [CVE-2021-4367](https://insights.sbomify.com/CVE-2021-4367/): Flo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site Scripting (medium 6.4)
- [CVE-2021-43669](https://insights.sbomify.com/CVE-2021-43669/): HTTP Request Smuggling in github.com/hyperledger/fabric (high 7.5)
- [CVE-2021-43668](https://insights.sbomify.com/CVE-2021-43668/): Denial of Service in Go-Ethereum (medium 5.5)
- [CVE-2021-43667](https://insights.sbomify.com/CVE-2021-43667/): NULL Pointer Dereference in HyperLedger Fabric (high 7.5)
- [CVE-2021-43666](https://insights.sbomify.com/CVE-2021-43666/): Denial of service in arm:mbed tls (high 7.5)
- [CVE-2021-43664](https://insights.sbomify.com/CVE-2021-43664/): Command injection in totolink:ex300 v2 firmware (high 8.1)
- [CVE-2021-43663](https://insights.sbomify.com/CVE-2021-43663/): Command injection in totolink:ex300 v2 firmware (high 7.5)
- [CVE-2021-43662](https://insights.sbomify.com/CVE-2021-43662/): Denial of service in totolink:a720r firmware (medium 6.5)
- [CVE-2021-43661](https://insights.sbomify.com/CVE-2021-43661/): Cross-site scripting in totolink:ex300 v2 firmware (medium 6.1)
- [CVE-2021-4366](https://insights.sbomify.com/CVE-2021-4366/): PWA for WP & AMP < = 1.7.32 - Missing Authorization (medium 6.3)
- [CVE-2021-43659](https://insights.sbomify.com/CVE-2021-43659/): File upload in halo:halo (medium 5.4)
- [CVE-2021-43657](https://insights.sbomify.com/CVE-2021-43657/): Cross-site scripting in simple client management system project:simple client management system (medium 5.4)
- [CVE-2021-43650](https://insights.sbomify.com/CVE-2021-43650/): SQL injection in softwell:webrun (critical 9.8)
- [CVE-2021-4365](https://insights.sbomify.com/CVE-2021-4365/): Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2021-4364](https://insights.sbomify.com/CVE-2021-4364/): JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function (medium 4.3)
- [CVE-2021-43638](https://insights.sbomify.com/CVE-2021-43638/): Integer overflow in amazon:workspaces (high 8.8)
- [CVE-2021-43637](https://insights.sbomify.com/CVE-2021-43637/): Memory corruption in amazon:workspaces (high 8.8)
- [CVE-2021-43636](https://insights.sbomify.com/CVE-2021-43636/): Memory corruption in totolink:t10 v2 firmware (critical 9.8)
- [CVE-2021-43635](https://insights.sbomify.com/CVE-2021-43635/): Cross-site scripting in codexnotes:codex (medium 6.1)
- [CVE-2021-43633](https://insights.sbomify.com/CVE-2021-43633/): Cross-site scripting in messaging web application project:messaging web application (medium 5.4)
- [CVE-2021-43631](https://insights.sbomify.com/CVE-2021-43631/): SQL injection in projectworlds:hospital management system in php (critical 9.8)
- [CVE-2021-43630](https://insights.sbomify.com/CVE-2021-43630/): SQL injection in projectworlds:hospital management system in php (high 8.8)
- [CVE-2021-4363](https://insights.sbomify.com/CVE-2021-4363/): WP Quick FrontEnd Editor <= 5.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2021-43629](https://insights.sbomify.com/CVE-2021-43629/): SQL injection in projectworlds:hospital management system in php (critical 9.8)
- [CVE-2021-43628](https://insights.sbomify.com/CVE-2021-43628/): SQL injection in projectworlds:hospital management system in php (critical 9.8)
- [CVE-2021-43620](https://insights.sbomify.com/CVE-2021-43620/): Improper Input Validation in fruity (high 7.5)
- [CVE-2021-4362](https://insights.sbomify.com/CVE-2021-4362/): Missing authorization in Social Sharing Plugin – Kiwi (critical 9.8)
- [CVE-2021-43619](https://insights.sbomify.com/CVE-2021-43619/): Memory corruption in trustedfirmware:trusted firmware-m (high 7.8)
- [CVE-2021-43618](https://insights.sbomify.com/CVE-2021-43618/): Integer overflow in debian:debian linux (high 7.5)
- [CVE-2021-43617](https://insights.sbomify.com/CVE-2021-43617/): File upload in laravel:framework (critical 9.8)
- [CVE-2021-43616](https://insights.sbomify.com/CVE-2021-43616/): Security feature bypass in fedoraproject:fedora (critical 9.0)
- [CVE-2021-43615](https://insights.sbomify.com/CVE-2021-43615/): Memory corruption in insyde:insydeh2o (high 8.2)
- [CVE-2021-43614](https://insights.sbomify.com/CVE-2021-43614/): VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution (medium 6.7)
- [CVE-2021-43613](https://insights.sbomify.com/CVE-2021-43613/): SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege (medium 6.5)
- [CVE-2021-43612](https://insights.sbomify.com/CVE-2021-43612/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2021-43611](https://insights.sbomify.com/CVE-2021-43611/): Denial of service in linphone:belle-sip (high 7.5)
- [CVE-2021-43610](https://insights.sbomify.com/CVE-2021-43610/): Denial of service in linphone:belle-sip (high 7.5)
- [CVE-2021-4361](https://insights.sbomify.com/CVE-2021-4361/): JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update (high 8.8)
- [CVE-2021-43609](https://insights.sbomify.com/CVE-2021-43609/): SQL injection in spiceworks:help desk server (critical 9.9)
- [CVE-2021-43608](https://insights.sbomify.com/CVE-2021-43608/): DBAL 3 SQL Injection Security Vulnerability (critical 9.8)
- [CVE-2021-4360](https://insights.sbomify.com/CVE-2021-4360/): Controlled Admin Access < 1.5.6 - Privilege Escalation (critical 9.9)
- [CVE-2021-43590](https://insights.sbomify.com/CVE-2021-43590/): Information disclosure in Dell EMC Enterprise Storage Analytics for vRealize Operations (medium 6.0)
- [CVE-2021-4359](https://insights.sbomify.com/CVE-2021-4359/): Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletion (medium 6.5)
- [CVE-2021-43589](https://insights.sbomify.com/CVE-2021-43589/): Command injection in Unity (medium 6.0)
- [CVE-2021-43588](https://insights.sbomify.com/CVE-2021-43588/): Denial of service in Data Protection Central (medium 4.3)
- [CVE-2021-43587](https://insights.sbomify.com/CVE-2021-43587/): Hardcoded credentials in PowerPath Management Appliance (high 8.2)
- [CVE-2021-43584](https://insights.sbomify.com/CVE-2021-43584/): Cross-site scripting in nagios:nagios cross platform agent (medium 4.8)
- [CVE-2021-43582](https://insights.sbomify.com/CVE-2021-43582/): Use after free in opendesign:drawings sdk (high 7.8)
- [CVE-2021-43581](https://insights.sbomify.com/CVE-2021-43581/): Memory corruption in opendesign:prc sdk (high 8.8)
- [CVE-2021-4358](https://insights.sbomify.com/CVE-2021-4358/): WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2021-43579](https://insights.sbomify.com/CVE-2021-43579/): Memory corruption in debian:debian linux (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2021/page/74/