Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (120062 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-47096 1 Virtualmin 1 Virtualmin 2024-11-21 5.4 Medium
A Reflected Cross-Site Scripting (XSS) vulnerability in the Cloudmin Services Client under System Setting in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Cloudmin services master field.
CVE-2023-47095 1 Virtualmin 1 Virtualmin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the Custom fields of Edit Virtual Server under System Customization in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Batch Label field while details of Virtual Server.
CVE-2023-47094 1 Virtualmin 1 Virtualmin 2024-11-21 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the Account Plans tab of System Settings in Virtualmin 7.7 allows remote attackers to inject arbitrary web script or HTML via the Plan name field while editing Account plan details.
CVE-2023-46998 1 Bootboxjs 1 Bootbox 2024-11-21 6.1 Medium
Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert(), confirm(), prompt() functions.
CVE-2023-46990 1 Publiccms 1 Publiccms 2024-11-21 9.8 Critical
Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace function.
CVE-2023-46987 1 Seacms 1 Seacms 2024-11-21 8.8 High
SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.
CVE-2023-46981 1 Xxyopen 1 Novel-plus 2024-11-21 9.8 Critical
SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/list.
CVE-2023-46980 1 Mayurik 1 Best Courier Management System 2024-11-21 9.8 Critical
An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter.
CVE-2023-46974 1 Mayurik 1 Courier Management System 2024-11-21 5.4 Medium
Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafted payload to the page parameter in the URL.
CVE-2023-46964 2 Hillstone, Hillstonenet 3 Next Generation Firewall Sg-6000-e3960, Sc-6000-e3960, Sc-6000-e3960 Firmware 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the use front-end filtering instead of back-end filtering.
CVE-2023-46963 1 Kaoshifeng 1 Yunfan Learning Examination System 2024-11-21 5.3 Medium
An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via the password parameter in the login function.
CVE-2023-46958 1 Lmxcms 1 Lmxcms 2024-11-21 9.8 Critical
An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.
CVE-2023-46956 1 Oretnom23 1 Packers And Movers Management System 2024-11-21 7.2 High
SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary code via crafted payload to the /mpms/admin/?page=user/manage_user&id file.
CVE-2023-46954 1 Relativity 1 Relativityone 2024-11-21 9.8 Critical
SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the name parameter.
CVE-2023-46947 1 Intelliants 1 Subrion 2024-11-21 8.8 High
Subrion 4.2.1 has a remote command execution vulnerability in the backend.
CVE-2023-46914 1 Bookingcalendar Project 1 Bookingcalendar 2024-11-21 9.8 Critical
SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via ics_export.php.
CVE-2023-46864 1 Peppermint 1 Peppermint 2024-11-21 5.3 Medium
Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ POST request.
CVE-2023-46863 1 Peppermint 1 Peppermint 2024-11-21 7.5 High
Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ POST request.
CVE-2023-46851 1 Apache 1 Allura 2024-11-21 4.9 Medium
Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could cause Allura to read local files and expose them.  Exposing internal files then can lead to other exploits, like session hijacking, or remote code execution. This issue affects Apache Allura from 1.0.1 through 1.15.0. Users are recommended to upgrade to version 1.16.0, which fixes the issue.  If you are unable to upgrade, set "disable_entry_points.allura.importers = forge-tracker, forge-discussion" in your .ini config file.
CVE-2023-46817 1 Phpfox 1 Phpfox 2024-11-21 9.8 Critical
An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a call to the unserialize() PHP function. This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP objects into the application scope, allowing them to perform a variety of attacks, such as executing arbitrary PHP code.