>> TAG: #0day

ImpressCMS v1.4.4 – Unrestricted File Upload

Cyclos 4.14.7 – DOM Based Cross-Site Scripting (XSS)

PHProjekt PhpSimplyGest v1.3. – Stored Cross-Site Scripting (XSS)

USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 – Remote Root Backdoor

MyBB 1.8.29 – MyBB 1.8.29 – Remote Code Execution (RCE) (Authenticated)

Beehive Forum – Account Takeover

WordPress Plugin Blue Admin 21.06.01 – Cross-Site Request Forgery (CSRF)

Joomla Plugin SexyPolling 2.1.7 – SQLi

WordPress Plugin stafflist 3.1.2 – SQLi (Authenticated)

Bitrix24 – Remote Code Execution (RCE) (Authenticated)