Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,864

CVE-2024-9477

XSS in AirTies' Air4443 Firmware

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AirTies Air4443 Firmware allows Cross-Site Scripting (XSS). This issue affects Air4443 Firmware: through 14102024. NOTE: The vendor was contacted and it was learned that the product classified as End-of-Life and End-of-Support.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Airties
Products
Air4443 Air4443 Firmware
CVE-2024-9819

IDOR in NextGEO's NG Analyser

Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse. This issue affects NG Analyser: before 2.2.711.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-10035

Code Injection in BG-TEK's CoslatV3

Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in BG-TEK Informatics Security Technologies CoslatV3 allows Command Injection, Privilege Escalation. This issue affects CoslatV3: through 3.1069. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Bg-tek
Products
Coslat Coslatv3 Firmware
CVE-2024-10244

SQLi in ISDO Software's Web Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ISDO Software Web Software allows SQL Injection. This issue affects Web Software: before 3.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-10534

Improper Access Control in Dataprom Informatics' PACS-ACSS

Origin Validation Error vulnerability in Dataprom Informatics Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS) allows Traffic Injection. This issue affects Personnel Attendance Control Systems (PACS) / Access Control Security Systems (ACSS): before 2024.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Dataprom Dataprom Informatics
Products
Personnel Attendance Control Systems \/ Access Control Security Systems Access Control Security Systems Personnel Attendance Control Systems
CVE-2024-10539

Reflected XSS in Uyumsoft's ERP

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uyumsoft Informatin Systems Uyumsoft ERP allows XSS Using Invalid Characters, Reflected XSS. This issue affects Uyumsoft ERP: before Erp4.2109.166p45.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-11142

CSRF in Gosoft Software's Proticaret E-Commerce

Cross-Site Request Forgery (CSRF) vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Proticaret
Products
Proticaret
CVE-2024-11216

Broken Access Control in PozitifIK's Pik Online

Authorization Bypass Through User-Controlled Key, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in PozitifIK Pik Online allows Account Footprinting, Session Hijacking. This issue affects Pik Online: before 3.1.5.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-11319

Stored XSS in Open Source Project "django-cms"

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django-cms allows Cross-Site Scripting (XSS). This issue affects django-cms: 3.11.7, 3.11.8, 4.1.2, 4.1.3.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Django-cms
Products
Django Cms
CVE-2024-11321

Reflected XSS in Hi e-learning's Learning Management System (LMS)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hi e-learning Learning Management System (LMS) allows Reflected XSS. This issue affects Learning Management System (LMS): before 06.12.2024.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-11404

File Upload Bypass in django Filer

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in django CMS Association django Filer allows Input Data Manipulation, Stored XSS. This issue affects django Filer: from 3 before 3.3.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-11406

Stored XSS in django CMS Attributes Fields

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in django CMS Association django CMS Attributes Fields allows Stored XSS. This issue affects django CMS Attributes Fields: before 4.0.

CVSS 3.1 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-11739

SQLi in Case Informatics' Case ERP

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Case Informatics Case ERP allows SQL Injection. This issue affects Case ERP: before V2.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12016

SQLi in CM Informatics' CM News

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CM Informatics CM News allows SQL Injection. This issue affects CM News: through 6.0. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12097

SQLi in Boceksoft Informatics' E-Travel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Boceksoft Informatics E-Travel allows SQL Injection. This issue affects E-Travel: before 15.12.2024.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-49372

Unauthenticated SSRF via Build Status in JetBrains TeamCity

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Teamcity
CVE-2026-49371

Reflected XSS in JetBrains TeamCity Keyword Filter

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Teamcity
CVE-2026-45700

Heap-buffer-overflow write in planar bitmap decoder

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.26.0, FreeRDP's planar bitmap decoder has an out-of-bounds heap write when decoding RLE planar data. In libfreerdp/codec/planar.c, freerdp_bitmap_decompress_planar() validates the X destination coordinate nXDst against the caller-provided destination stride (nDstStep) even when it is writing into the internal temp buffer pTempData. An attacker can bypass the check with a large nDstStep and a large nXDst, causing planar_decompress_plane_rle() to write past the end of pTempData. This vulnerability is fixed in 3.26.0.

CVSS 4.0 · 7.7 High EPSS 6.1% KEV · Not listed
Vendors
Freerdp
Products
Freerdp
CVE-2026-45662

Dokploy: Command Injection via incomplete shell escaping in docker logout (registry deletion)

Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.0 and earlier, the deleteRegistry function in Dokploy (packages/server/src/services/registry.ts) executes docker logout ${response.registryUrl} without shell escaping. In the same file, the docker login command correctly uses shEscape() to prevent command injection. This inconsistency creates a command injection vulnerability when deleting a registry with a crafted registryUrl.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed
Vendors
Dokploy
Products
Dokploy
CVE-2026-10114

Open5GS Shared NF-profile nnrf-handler.c handle_scp_info out-of-bounds write

A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function handle_scp_info in the library lib/sbi/nnrf-handler.c of the component Shared NF-profile Parser. This manipulation causes out-of-bounds write. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. To fix this issue, it is recommended to deploy a patch.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Open5gs
Products
Open5gs