Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2024-7026

SQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknogis Informatics Closed Circuit Vehicle Tracking Software allows SQL Injection, Blind SQL Injection. This issue affects Closed Circuit Vehicle Tracking Software: through 21.11.2024. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Teknogis Informatics
Products
Close Circuit Vehicle Tracking Software
CVE-2024-7071

Unauthenticate SQLi in Brain Information Technologies' Brain Low-Code

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE - 564 - SQL Injection: Hibernate vulnerability in Brain Information Technologies Inc. Brain Low-Code allows SQL Injection. This issue affects Brain Low-Code: before 2.1.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Brain Information Technologies Brainlowcode
Products
Brain Low-code Brain Low-code
CVE-2024-7076

SQLi in Semtek Informatics Software's Semtek Sempos

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Blind SQL Injection. This issue affects Semtek Sempos: through 31072024.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Semtek Semtekyazilim
Products
Sempos Semtek Sempos
CVE-2024-7077

Reflected XSS in Semtek Informatics Software's Semtek Sempos

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows Reflected XSS. This issue affects Semtek Sempos: through 31072024.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Semtekyazilim
Products
Semtek Sempos
CVE-2024-7078

Unauthenticate SQLi in Semtek Informatics Software's Semtek Sempos

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows SQL Injection. This issue affects Semtek Sempos: through 31072024.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Semtek Semtekyazilim
Products
Sempos Semtek Sempos
CVE-2024-7098

XML Injection in SFS Consulting's ww.Winsure

Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4.6.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Sfs Sfs Consulting
Products
Winsure Wwwinsure
CVE-2024-7104

Remote Code Execution in SFS Consulting's ww.Winsure

Improper Control of Generation of Code ('Code Injection') vulnerability in SFS Consulting ww.Winsure allows Code Injection. This issue affects ww.Winsure: before 4.6.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Sfs Sfs Consulting
Products
Winsure Wwwinsure
CVE-2024-7107

Directory Traversal in National Keep's CyberMath

Files or Directories Accessible to External Parties vulnerability in National Keep Cyber Security Services CyberMath allows Collect Data from Common Resource Locations. This issue affects CyberMath: before CYBM.240816253.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath
CVE-2024-7108

Incorrect Authorization in National Keep's CyberMath

Incorrect Authorization vulnerability in National Keep Cyber Security Services CyberMath allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects CyberMath: before CYBM.240816253.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Nationalkeep
Products
Cybermath
CVE-2024-7130

Reflected XSS in Kion Computer's KION Exchange Programs Software

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kion Computer KION Exchange Programs Software allows Reflected XSS. This issue affects KION Exchange Programs Software: before 1.21.9092.29966.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-7488

Business Logic Error in RestApp Inc.'s Online Ordering System

Integer Overflow or Wraparound, Improper Validation of Specified Quantity in Input vulnerability in RestApp Inc. Online Ordering System allows Integer Attacks. This issue affects Online Ordering System: 8.2.1. NOTE: Vulnerability fixed in version 8.2.2 and does not exist before 8.2.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Restapp
Products
Online Ordering System
CVE-2024-7609

Directory Traversal in Vidco Software's VOC TESTER

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Vidco Software VOC TESTER allows Path Traversal. This issue affects VOC TESTER: before 12.34.8.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Vidco
Products
Voc Tester
CVE-2024-7735

SQLi in Exnet Informatics Software's Ferry Reservation System

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Exnet Informatics Software Ferry Reservation System allows SQL Injection. This issue affects Ferry Reservation System: before 240805-002.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Exnet Informatics Software
Products
Ferry Reservation System
CVE-2024-7785

Reflected XSS in Ece Software's Electronic Ticket System

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ece Software Electronic Ticket System allows Reflected XSS, Cross-Site Scripting (XSS). This issue affects Electronic Ticket System: before 2024.08.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-7787

Reflected XSS in ITG Computer Technology's vSRM Supplier Relationship Management System

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ITG Computer Technology vSRM Supplier Relationship Management System allows Reflected XSS, Cross-Site Scripting (XSS). This issue affects vSRM Supplier Relationship Management System: before 28.08.2024.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-7835

Reflected XSS in Exnet Informatics Software's Ferry Reservation System

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Exnet Informatics Software Ferry Reservation System allows Reflected XSS. This issue affects Ferry Reservation System: before 240805-002.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Exnet Informatics Software
Products
Ferry Reservation System
CVE-2026-5076

ARMember Premium <= 7.3.1 - Insecure Password Reset Mechanism to Unauthenticated Privilege Escalation

The ARMember Premium plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 7.3.1. The plugin stores a plaintext copy of the password reset key in the `arm_reset_password_key` user meta field when a user requests a password reset. This is in addition to the hashed key that WordPress core stores securely in `wp_users.user_activation_key`. The plaintext key stored in `wp_usermeta` can be used with the plugin's custom `armrp` reset action to set a new password for any user. Combined with another vulnerability such as SQL Injection (CVE-2026-5073, CVE-2026-5074), this makes it possible for unauthenticated attackers to extract the plaintext reset key and take over any user account, including administrators.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Armember Wordpress
Products
Armember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup Wordpress
CVE-2026-5074

ARMember Premium <= 7.3.1 - Authenticated (Subscriber+) SQL Injection via 'sSortDir_0' Parameter

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the `get_private_content_data` AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient sanitization of the user-supplied parameter which is concatenated directly into the ORDER BY clause of an SQL query without a whitelist check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Note: The vulnerability can only be exploited if the "User Private Content" addon is enabled, which is disabled by default..

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Armember Wordpress
Products
Armember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup Wordpress
CVE-2026-5073

ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection via 'order' Parameter

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of sufficient preparation on the existing SQL query in the `arm_get_directory_members()` function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Armember Wordpress
Products
Armember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User Signup Wordpress
CVE-2026-10621

CVE-2026-10621

Path traversal in restore handler in Collibra Agent, allows an attacker to write arbitrary files via a crafted ZIP archive. Collibra Agent fails to properly validate and canonicalize file path during ZIP extraction, this can allow an attacker to write files outside the intended extraction directory.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Collibra
Products
Collibra Platform (on-prem) Collibra Platform (saas)