Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (119141 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-26420 1 Microsoft 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server 2024-11-21 7.1 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2021-26412 1 Microsoft 1 Exchange Server 2024-11-21 9.1 Critical
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26263 1 Odoo 3 Odoo, Odoo Community, Odoo Enterprise 2024-11-21 6.1 Medium
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
CVE-2021-26247 1 Cacti 1 Cacti 2024-11-21 6.1 Medium
As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter.
CVE-2021-26232 1 Simple College Website Project 1 Simple College Website 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php.
CVE-2021-26231 1 Fantastic Blog Cms Project 1 Fantastic Blog Cms 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to category.php.
CVE-2021-26230 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to save_user.php.
CVE-2021-26229 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_stud.php.
CVE-2021-26228 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_class1.php.
CVE-2021-26227 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the student information parameters to edit_stud.php.
CVE-2021-26226 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_user.php.
CVE-2021-26224 1 Fantastic Blog Project 1 Fantastic Blog 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php.
CVE-2021-26223 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_pay.php.
CVE-2021-26103 1 Fortinet 2 Fortios, Fortiproxy 2024-11-21 6.3 Medium
An insufficient verification of data authenticity vulnerability (CWE-345) in the user interface of FortiProxy verison 2.0.3 and below, 1.2.11 and below and FortiGate verison 7.0.0, 6.4.6 and below, 6.2.9 and below of SSL VPN portal may allow a remote, unauthenticated attacker to conduct a cross-site request forgery (CSRF) attack . Only SSL VPN in web mode or full mode are impacted by this vulnerability.
CVE-2021-26095 1 Fortinet 1 Fortimail 2024-11-21 7.5 High
The combination of various cryptographic issues in the session management of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6, including the encryption construction of the session cookie, may allow a remote attacker already in possession of a cookie to possibly reveal and alter or forge its content, thereby escalating privileges.
CVE-2021-26092 1 Fortinet 2 Fortios, Fortiproxy 2024-11-21 4.7 Medium
Failure to sanitize input in the SSL VPN web portal of FortiOS 5.2.10 through 5.2.15, 5.4.0 through 5.4.13, 5.6.0 through 5.6.14, 6.0.0 through 6.0.12, 6.2.0 through 6.2.7, 6.4.0 through 6.4.4; and FortiProxy 1.2.0 through 1.2.9, 2.0.0 through 2.0.1 may allow a remote unauthenticated attacker to perform a reflected Cross-site Scripting (XSS) attack by sending a request to the error page with malicious GET parameters.
CVE-2021-26090 1 Fortinet 1 Fortimail 2024-11-21 5.3 Medium
A missing release of memory after its effective lifetime vulnerability in the Webmail of FortiMail 6.4.0 through 6.4.4 and 6.2.0 through 6.2.6 may allow an unauthenticated remote attacker to exhaust available memory via specifically crafted login requests.
CVE-2021-26083 1 Atlassian 4 Data Center, Jira, Jira Data Center and 1 more 2024-11-21 5.4 Medium
Export HTML Report in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
CVE-2021-26082 1 Atlassian 4 Data Center, Jira, Jira Data Center and 1 more 2024-11-21 5.4 Medium
The XML Export in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a stored cross site scripting vulnerability.
CVE-2021-26081 1 Atlassian 4 Data Center, Jira, Jira Data Center and 1 more 2024-11-21 5.3 Medium
REST API in Atlassian Jira Server and Jira Data Center before version 8.5.14, from version 8.6.0 before 8.13.6, and from version 8.14.0 before 8.16.1 allows remote attackers to enumerate usernames via a Sensitive Data Exposure vulnerability in the `/rest/api/latest/user/avatar/temporary` endpoint.