https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-42544.htmlhttps://patchthecve.com/cve/CVE-2021-42544.htmlWed, 17 Jun 2026 04:09:48 +0000HIGH 7.5: Missing Rate Limiting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on the Login Form allows an unauthenticated remote attacker to perform multiple login attempts, which facilitates gaining privileges.https://patchthecve.com/cve/CVE-2021-42123.htmlhttps://patchthecve.com/cve/CVE-2021-42123.htmlWed, 17 Jun 2026 04:09:23 +0000HIGH 7.3: Unrestricted File Upload in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 in the File Upload Functions allows an authenticated remote attacker with Upload privileges to upload files with any file type, enabling client-side attacks.https://patchthecve.com/cve/CVE-2021-42122.htmlhttps://patchthecve.com/cve/CVE-2021-42122.htmlWed, 17 Jun 2026 04:09:23 +0000MEDIUM 4.3: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s attributes with numeric format allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format, which makes the ahttps://patchthecve.com/cve/CVE-2021-42121.htmlhttps://patchthecve.com/cve/CVE-2021-42121.htmlWed, 17 Jun 2026 04:09:22 +0000MEDIUM 4.3: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on an object’s date attribute(s) allows an authenticated remote attacker with Object Modification privileges to insert an unexpected format into date fields, which leads thttps://patchthecve.com/cve/CVE-2021-42120.htmlhttps://patchthecve.com/cve/CVE-2021-42120.htmlWed, 17 Jun 2026 04:09:22 +0000MEDIUM 6.5: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 on all object attributes allows an authenticated remote attacker with Object Modification privileges to insert arbitrarily long strings, eventually leading to exhaustion ohttps://patchthecve.com/cve/CVE-2021-42119.htmlhttps://patchthecve.com/cve/CVE-2021-42119.htmlWed, 17 Jun 2026 04:09:22 +0000HIGH 7.3: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Search Functionality allows authenticated users with Object Modification privileges to inject arbitrary HTML and JavaScript in object attributes, which is then rhttps://patchthecve.com/cve/CVE-2021-42118.htmlhttps://patchthecve.com/cve/CVE-2021-42118.htmlWed, 17 Jun 2026 04:09:22 +0000HIGH 8.1: Persistent Cross Site Scripting in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 via the Structure Component allows an authenticated remote attacker with Object Modification privileges to inject arbitrary HTML and JavaScript code in an object attribuhttps://patchthecve.com/cve/CVE-2021-42117.htmlhttps://patchthecve.com/cve/CVE-2021-42117.htmlWed, 17 Jun 2026 04:09:22 +0000LOW 3.5: Insufficient Input Validation in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker with Object Modification privileges to insert arbitrary HTML without code execution.https://patchthecve.com/cve/CVE-2021-42116.htmlhttps://patchthecve.com/cve/CVE-2021-42116.htmlWed, 17 Jun 2026 04:09:22 +0000MEDIUM 4.3: Incorrect Access Control in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an authenticated remote attacker to view the Shape Editor and Settings, which are functionality for higher privileged users, via identifying said components in the fronthttps://patchthecve.com/cve/CVE-2021-42115.htmlhttps://patchthecve.com/cve/CVE-2021-42115.htmlWed, 17 Jun 2026 04:09:22 +0000HIGH 8.1: Missing HTTPOnly flag in Web Applications operating on Business-DNA Solutions GmbH’s TopEase® Platform Version <= 7.1.27 allows an unauthenticated remote attacker to escalate privileges from unauthenticated to authenticated user via stealing and injecting the session- independent and static cookie U