Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323840 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-18640 5 Fedoraproject, Oracle, Quarkus and 2 more 8 Fedora, Peoplesoft Enterprise Pt Peopletools, Quarkus and 5 more 2024-11-21 7.5 High
The Alias feature in SnakeYAML before 1.26 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
CVE-2017-18639 1 Progress 1 Sitefinity Cms 2024-11-21 6.1 Medium
Progress Sitefinity CMS before 10.1 allows XSS via /Pages Parameter : Page Title, /Content/News Parameter : News Title, /Content/List Parameter : List Title, /Content/Documents/LibraryDocuments/incident-request-attachments Parameter : Document Title, /Content/Images/LibraryImages/newsimages Parameter : Image Title, /Content/links Parameter : Link Title, /Content/links Parameter : Link Title, or /Content/Videos/LibraryVideos/default-video-library Parameter : Video Title.
CVE-2017-18638 1 Graphite Project 1 Graphite 2024-11-21 7.5 High
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information.
CVE-2017-18636 1 Esafenet 1 Cdg 2024-11-21 7.5 High
CDG through 2017-01-01 allows downloadDocument.jsp?command=download&pathAndName= directory traversal.
CVE-2017-18635 4 Canonical, Debian, Novnc and 1 more 5 Ubuntu Linux, Debian Linux, Novnc and 2 more 2024-11-21 6.1 Medium
An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.
CVE-2017-18634 1 Tagdiv 1 Newspaper 2024-11-21 9.8 Critical
The newspaper theme before 6.7.2 for WordPress has script injection via td_ads[header] to admin-ajax.php.
CVE-2017-18615 1 Wp-kama 1 Kama Click Counter 2024-11-21 6.1 Medium
The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.
CVE-2017-18614 1 Wp-kama 1 Kama Click Counter 2024-11-21 8.1 High
The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter.
CVE-2017-18613 1 Trust Form Project 1 Trust Form 2024-11-21 6.1 Medium
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.
CVE-2017-18612 1 Netattingo 1 Wp-whois-domain 2024-11-21 6.1 Medium
The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.
CVE-2017-18611 1 Magicfields 1 Magic Fields 2024-11-21 6.1 Medium
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.
CVE-2017-18610 1 Magicfields 1 Magic Fields 2024-11-21 6.1 Medium
The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.
CVE-2017-18609 1 Magicfields 1 Magic Fields 2024-11-21 6.1 Medium
The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.
CVE-2017-18608 1 Spot 1 Spot.im Comments 2024-11-21 6.1 Medium
The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.
CVE-2017-18607 1 Theme-fusion 1 Avada 2024-11-21 8.8 High
The avada theme before 5.1.5 for WordPress has CSRF.
CVE-2017-18606 1 Theme-fusion 1 Avada 2024-11-21 6.1 Medium
The avada theme before 5.1.5 for WordPress has stored XSS.
CVE-2017-18605 1 Gravitatedesign 1 Gravitate Qa Tracker 2024-11-21 9.8 Critical
The gravitate-qa-tracker plugin through 1.2.1 for WordPress has PHP Object Injection.
CVE-2017-18604 1 Sitebuilder Dynamic Components Project 1 Sitebuilder Dynamic Components 2024-11-21 7.5 High
The sitebuilder-dynamic-components plugin through 1.0 for WordPress has PHP object injection via an AJAX request.
CVE-2017-18603 1 Postman-smtp Project 1 Postman-smtp 2024-11-21 6.1 Medium
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postman_email_log page parameter.
CVE-2017-18602 1 Ibps Online Exam Project 1 Ibps Online Exam 2024-11-21 8.8 High
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examapp_UserResult id parameter.