PT-2021-15873

Name of the Vulnerable Software and Affected Versions Video Embed WordPress plugin versions 1.0 and earlier Description The issue concerns the id GET parameter in one of the Video Embed WordPress plugin's pages, which is accessible via forced browsing. This parameter is not sanitized, validated, ...

CVE-2021-24337: Improper Neutralization of Special Elements used in an SQL Command

The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection...

WordPress plugin SQL injection vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an application plugin for WordPress. A SQL injection vulnerability exists in WordPress Vide...

Video Embed <= 1.0 - Authenticated (subscriber+) SQL Injection

The id GET parameter of one of the plugin's page available via forced browsing is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. PoC Note: The URL /wp-admin/admin.php?page=edit-video-embed=1 is...

WordPress Video Embed plugin <= 1.0 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Syed Sheeraz Ali Code Vigilant Project in WordPress Video Embed plugin versions = 1.0. Solution This plugin has been closed as of April 19, 2021 and is not available for download. This closure is temporary, pending a full review...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4028 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2021-24122 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +6056 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.39)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2021-24122 Source...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.dstack:server-base-local (>=0.0.12, <=0.1.15) +6056 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.1, <=9.0.39)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.1, =4.4.0.0, =0.0.12, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =j8.2.2.0, =greenwich.sr1, =greenwich.sr2, =greenwich.sr1, =greenwich.sr1, =greenwich.sr2, =greenwich.sr2.1 and more Source cves: CVE-2021-24122 Source...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +4028 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.59)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2021-24122 Source...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +285 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.106)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2021-24122 Source advisory: OSV:GHSA-2RVV-W9R2-RG7M...

ch.ralscha:embeddedtc (>=0.0.1, <=0.0.9), ch.rasc:embeddedtc (>=1.0, <=1.29) +285 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=7.0.0, <=7.0.106)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =7.0.0, =0.0.1, =1.0, =1.0, =1.0-beta-1, =2.0.19, =0.10.1, =1.0-release, =1.0-release, =0.1, =0.4, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2021-24122 Source advisory: GHSA-2RVV-W9R2-RG7M...

com.github.fanzezhen.common:common-security (>=0.0.1, <=2.0.3), com.github.fanzezhen:security (>=1.3.3, <=1.3.4.4) +4 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.0.1, =1.3.3, =5.22, =10.0.0-m1, =10.0.0-m1, =10.0.0-m9 - org.jboss.arquillian.container:arquillian-tomcat-embedded-10 1.2.0.alpha1 Source cves: CVE-2021-24122 Source advisory: GHSA-2RVV-W9R2-RG7M...

com.github.fanzezhen.common:common-security (>=0.0.1, <=2.0.3), com.github.fanzezhen:security (>=1.3.3, <=1.3.4.4) +4 more potentially affected by CVE-2021-24122 via org.apache.tomcat.embed:tomcat-embed-core (>=10.0.0-m1, <=10.0.0-m9)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =10.0.0-m1, =0.0.1, =1.3.3, =5.22, =10.0.0-m1, =10.0.0-m1, =10.0.0-m9 - org.jboss.arquillian.container:arquillian-tomcat-embedded-10 1.2.0.alpha1 Source cves: CVE-2021-24122 Source advisory: OSV:GHSA-2RVV-W9R2-RG7M...

Cross-site Scripting in Joplin

An XSS issue in Joplin desktop allows arbitrary code execution via a malicious HTML embed tag...

GHSA-CGC7-MWP4-3CCX Cross-site Scripting in Joplin

An XSS issue in Joplin desktop allows arbitrary code execution via a malicious HTML embed tag...

@ace-rbk/ckeditor-build-full-options (>=2.1.1, <=2.2.0), @arslanshahab/ckeditor5-build-classic (25.0.0) +232 more potentially affected by CVE-2021-21391 via @ckeditor/ckeditor5-media-embed (>=0.0.0-internal-20241017.0, <=26.0.0)

@ckeditor/ckeditor5-media-embed NPM version =0.0.0-internal-20241017.0, =2.1.1, =1.0.1, =0.25.0, =0.0.1, =0.0.1, =0.25.1, =25.0.1, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-internal-20241017.0, =0.0.0-nightly-next-20260105.0 and more Source cves: CVE-2021-21391 Source advisor...

CVE-2021-21391

CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...

CVE-2021-21391: Uncontrolled Resource Consumption

CKEditor 5 provides a WYSIWYG editing solution. This CVE affects the following npm packages: ckeditor5-engine, ckeditor5-font, ckeditor5-image, ckeditor5-list, ckeditor5-markdown-gfm, ckeditor5-media-embed, ckeditor5-paste-from-office, and ckeditor5-widget. Following an internal audit, a regular...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2021-29434 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2021-29434 Source advisory: OSV:GHSA-WQ5H-F9P5-Q7FX...

wagtail-stacks-embed (>=0.1.0, <=0.3.0) potentially affected by CVE-2021-29434 via wagtail (1.7.0)

wagtail PYPI version 1.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-stacks-embed =0.1.0, =0.3.0 Source cves: CVE-2021-29434 Source advisory: OSV:PYSEC-2021-114...