Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (366926 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-2429 1 Phpmyfaq 1 Phpmyfaq 2025-01-30 9.8 Critical
Improper Access Control in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVE-2023-2428 1 Phpmyfaq 1 Phpmyfaq 2025-01-30 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
CVE-2023-29918 1 Rosariosis 1 Rosariosis 2025-01-30 5.4 Medium
RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
CVE-2023-29868 1 Zammad 1 Zammad 2025-01-30 6.5 Medium
Zammad 5.3.x (Fixed in 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker with agent and customer roles could perform unauthorized changes on articles where they only have customer permissions.
CVE-2023-29867 1 Zammad 1 Zammad 2025-01-30 6.5 Medium
Zammad 5.3.x (Fixed 5.4.0) is vulnerable to Incorrect Access Control. An authenticated attacker could gain information about linked accounts of users involved in their tickets using the Zammad API.
CVE-2023-29778 1 Gl-inet 2 Gl-mt3000, Gl-mt3000 Firmware 2025-01-30 9.8 Critical
GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.
CVE-2023-29772 1 Asus 2 Rt-ac51u, Rt-ac51u Firmware 2025-01-30 5.2 Medium
A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC51U wireless router firmware version up to and including 3.0.0.4.380.8591 allows remote attackers to inject arbitrary web script or HTML via a malicious network request.
CVE-2023-29638 1 Winterchen 1 My-site 2025-01-30 5.4 Medium
Cross Site Scripting (XSS) vulnerability in WinterChenS my-site before commit 3f0423da6d5200c7a46e200da145c1f54ee18548, allows attackers to inject arbitrary web script or HTML via editing blog articles.
CVE-2023-29637 1 Qbian61 Forum-java Project 1 Qbian61 Forum-java 2025-01-30 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Qbian61 forum-java, allows attackers to inject arbitrary web script or HTML via editing the article content in the "article editor" page.
CVE-2023-29635 1 Antabot White-jotter Project 1 Antabot White-jotter 2025-01-30 9.8 Critical
File upload vulnerability in Antabot White-Jotter v0.2.2, allows remote attackers to execute malicious code via the file parameter to function coversUpload.
CVE-2023-27892 1 Shapeshift 2 Keepkey, Keepkey Firmware 2025-01-30 3.8 Low
Insufficient length checks in the ShapeShift KeepKey hardware wallet firmware before 7.7.0 allow a global buffer overflow via crafted messages. Flaws in cf_confirmExecTx() in ethereum_contracts.c can be used to reveal arbitrary microcontroller memory on the device screen or crash the device. With physical access to a PIN-unlocked device, attackers can extract the BIP39 mnemonic secret from the hardware wallet.
CVE-2023-27108 1 Kaiostech 1 Kaios 2025-01-30 5.3 Medium
An issue was discovered in KaiOS 3.0. The pre-installed Communications application exposes a Web Activity that returns the user's call log without origin or permission checks. An attacker can inject a JavaScript payload that runs in a browser or app without user interaction or consent. This allows an attacker to send the user's call logs to a remote server via XMLHttpRequest or Fetch.
CVE-2023-27035 1 Obsidian 1 Obsidian 2025-01-30 6.5 Medium
An issue discovered in Obsidian Canvas 1.1.9 allows remote attackers to send desktop notifications, record user audio and other unspecified impacts via embedded website on the canvas page.
CVE-2023-26987 1 Konga Project 1 Konga 2025-01-30 6.5 Medium
An issue discovered in Konga 0.14.9 allows remote attackers to manipulate user accounts regardless of privilege via crafted POST request.
CVE-2023-26546 1 Echa.europa 1 Iuclid 2025-01-30 8.8 High
European Chemicals Agency IUCLID before 6.27.6 allows remote authenticated users to execute arbitrary code via Server Side Template Injection (SSTI) with a crafted template file. The attacker must have template manager permission.
CVE-2023-26089 1 Echa.europa 1 Iuclid 2025-01-30 9.8 Critical
European Chemicals Agency IUCLID 6.x before 6.27.6 allows authentication bypass because a weak hard-coded secret is used for JWT signing. The affected versions are 5.15.0 through 6.27.5.
CVE-2022-48483 1 3cx 1 3cx 2025-01-30 7.5 High
3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an incomplete fix for CVE-2022-28005.
CVE-2022-40302 3 Debian, Frrouting, Redhat 3 Debian Linux, Frrouting, Enterprise Linux 2025-01-30 6.5 Medium
An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), attackers may cause a denial of service (assertion failure and daemon restart, or out-of-bounds read). This is possible because of inconsistent boundary checks that do not account for reading 3 bytes (instead of 2) in this 0xff case.
CVE-2022-35898 1 Opentext 1 Bizmanager 2025-01-30 9.8 Critical
OpenText BizManager before 16.6.0.1 does not perform proper validation during the change-password operation. This allows any authenticated user to change the password of any other user, including the Administrator account.
CVE-2022-31643 1 Hp 182 Dragonfly Folio G3, Dragonfly Folio G3 Firmware, Elite Dragonfly G2 and 179 more 2025-01-30 5.5 Medium
A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability.