EUVD-2021-9984

Malicious code in bioql PyPI...

CVE-2021-22847

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege...

CVE-2021-22849

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

Privilege escalation

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege...

Cross site scripting

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

CVE-2021-22849 Hyweb HyCMS-J1 - Stored XSS

Hyweb HyCMS-J1 backend editing function does not filter special characters. Users after log-in can inject JavaScript syntax to perform a stored XSS Stored Cross-site scripting attack...

CVE-2021-22849

CVE-2021-22849 affects Hyweb HyCMS-J1; the backend editing function does not filter special characters, enabling stored XSS where logged-in users can inject JavaScript. Root cause: insufficient input sanitization on editing payloads. Documented impact includes stored XSS risk with potential parti...

CVE-2021-22847 Hyweb HyCMS-J1 - SQL Injection

Hyweb HyCMS-J1's API fail to filter POST request parameters. Remote attackers can inject SQL syntax and execute commands without privilege...

CVE-2021-22847

The CVE-2021-22847 entry affects Hyweb HyCMS-J1. The root cause is failure to filter POST request parameters in the API, enabling remote SQL injection and command execution without privileges. The vulnerability is reported with an NVD score of 8.8 (CVSS-3.1, HIGH) and 6.5 (CVSS-2.0, MEDIUM) with ...

Hyweb HyCMS-J Cross-Site Scripting Vulnerability

Hyweb HyCMS-J1 is a text management system from the Chinese company Hyweb. Hyweb HyCMS-J1 suffers from a cross-site scripting vulnerability that stems from the back-end editing function not filtering special characters. An attacker can exploit this vulnerability to inject JavaScript syntax to...