Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (119695 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-41567 1 Tad Uploader Project 1 Tad Uploader 2024-11-21 6.1 Medium
The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
CVE-2021-41566 1 Tadtools Project 1 Tadtools 2024-11-21 9.8 Critical
The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.
CVE-2021-41565 1 Tadtools Project 1 Tadtools 2024-11-21 6.1 Medium
TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks.
CVE-2021-41564 1 Tad Honor Project 1 Tad Honor 2024-11-21 5.3 Medium
Tad Honor viewing book list function is vulnerable to authorization bypass, thus remote attackers can use special parameters to delete articles arbitrarily without logging in.
CVE-2021-41563 1 Tad Book3 Project 1 Tad Book3 2024-11-21 6.1 Medium
Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
CVE-2021-41560 1 Opencats 1 Opencats 2024-11-21 9.8 Critical
OpenCATS through 0.9.6 allows remote attackers to execute arbitrary code by uploading an executable file via lib/FileUtility.php.
CVE-2021-41559 1 Silverstripe 1 Silverstripe 2024-11-21 6.5 Medium
Silverstripe silverstripe/framework 4.8.1 has a quadratic blowup in Convert::xml2array() that enables a remote attack via a crafted XML document.
CVE-2021-41547 1 Siemens 1 Teamcenter Active Workspace 2024-11-21 7.2 High
A vulnerability has been identified in Teamcenter Active Workspace V4.3 (All versions < V4.3.11), Teamcenter Active Workspace V5.0 (All versions < V5.0.10), Teamcenter Active Workspace V5.1 (All versions < V5.1.6), Teamcenter Active Workspace V5.2 (All versions < V5.2.3). The application contains an unsafe unzipping pattern that could lead to a zip path traversal attack. This could allow and attacker to execute a remote shell with admin rights.
CVE-2021-41499 1 Pyo Project 1 Pyo 2024-11-21 7.5 High
Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to conduct DoS attacks by deliberately passing on an overlong audio file name.
CVE-2021-41467 1 Justwriting Project 1 Justwriting 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
CVE-2021-41465 1 Concrete5-legacy Project 1 Concrete5-legacy 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_theme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVE-2021-41464 1 Concrete5-legacy Project 1 Concrete5-legacy 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter.
CVE-2021-41463 1 Concrete5-legacy Project 1 Concrete5-legacy 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in toos/permissions/dialogs/access/entity/types/group_combination.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the cID parameter.
CVE-2021-41462 1 Concrete5-legacy Project 1 Concrete5-legacy 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the ctID parameter.
CVE-2021-41461 1 Concrete5-legacy Project 1 Concrete5-legacy 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in concrete/elements/collection_add.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the mode parameter.
CVE-2021-41451 1 Tp-link 2 Archer Ax10, Archer Ax10 Firmware 2024-11-21 7.5 High
A misconfiguration in HTTP/1.0 and HTTP/1.1 of the web interface in TP-Link AX10v1 before V1_211117 allows a remote unauthenticated attacker to send a specially crafted HTTP request and receive a misconfigured HTTP/0.9 response, potentially leading into a cache poisoning attack.
CVE-2021-41450 1 Tp-link 2 Archer Ax10 V1, Archer Ax10 V1 Firmware 2024-11-21 7.5 High
An HTTP request smuggling attack in TP-Link AX10v1 before v1_211117 allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.
CVE-2021-41449 1 Netgear 6 Rax35, Rax35 Firmware, Rax38 and 3 more 2024-11-21 7.1 High
A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated attacker to gain access to sensitive restricted information, such as forbidden files of the web application, via sending a specially crafted HTTP packet.
CVE-2021-41445 1 Dlink 2 Dir-x1860, Dir-x1860 Firmware 2024-11-21 6.1 Medium
A reflected cross-site-scripting attack in web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to execute code in the device of the victim via sending a specific URL to the unauthenticated victim.
CVE-2021-41442 1 Dlink 2 Dir-x1860, Dir-x1860 Firmware 2024-11-21 7.5 High
An HTTP smuggling attack in the web application of D-Link DIR-X1860 before v1.10WWB09_Beta allows a remote unauthenticated attacker to DoS the web application via sending a specific HTTP packet.