Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (118583 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-24231 1 Jumpmind 1 Symmetricds 2024-11-21 9.8 Critical
Symmetric DS <3.12.0 uses mx4j to provide access to JMX over HTTP. mx4j, by default, has no auth and is available on all interfaces. An attacker can interact with JMX: get system info, and invoke MBean methods. It is possible to install additional MBeans from a remote host using MLet that leads to arbitrary code execution.
CVE-2020-24208 1 Online Shopping Alphaware Project 1 Online Shopping Alphaware 2024-11-21 9.8 Critical
A SQL injection vulnerability in SourceCodester Online Shopping Alphaware 1.0 allows remote unauthenticated attackers to bypass the authentication process via email and password parameters.
CVE-2020-24203 1 Projectworlds 1 Travel Management System 2024-11-21 9.8 Critical
Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.
CVE-2020-24202 1 Projectworlds 1 House Rental And Property Listing Project 2024-11-21 9.8 Critical
File Upload component in Projects World House Rental v1.0 suffers from an arbitrary file upload vulnerability with regular users, which allows remote attackers to conduct code execution.
CVE-2020-24199 1 Projectworlds 1 Car Rental Project 2024-11-21 9.8 Critical
Arbitrary File Upload in the Vehicle Image Upload component in Project Worlds Car Rental Management System v1.0 allows attackers to conduct remote code execution.
CVE-2020-24198 1 Stock Management System Project 1 Stock Management System 2024-11-21 6.1 Medium
A persistent cross-site scripting vulnerability in Sourcecodester Stock Management System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'Brand Name.'
CVE-2020-24197 1 Stock Management System Project 1 Stock Management System 2024-11-21 9.8 Critical
A SQL injection vulnerability in the login component in Stock Management System v1.0 allows remote attacker to execute arbitrary SQL commands via the username parameter.
CVE-2020-24196 1 Online Bike Rental Project 1 Online Bike Rental 2024-11-21 7.2 High
An Arbitrary File Upload in Vehicle Image Upload in Online Bike Rental v1.0 allows authenticated admin to conduct remote code execution.
CVE-2020-24195 1 Online Bike Rental Project 1 Online Bike Rental 2024-11-21 9.1 Critical
An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.
CVE-2020-24194 1 Daily Tracker System Project 1 Daily Tracker System 2024-11-21 6.1 Medium
A Cross-site scripting (XSS) vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter.
CVE-2020-24188 1 Unitedplanet 1 Intrexx 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in the search functionality in Intrexx before 9.4.0 allows remote attackers to inject arbitrary web script or HTML via the request parameter.
CVE-2020-24186 1 Gvectors 1 Wpdiscuz 2024-11-21 10 Critical
A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
CVE-2020-24145 1 Cminds 1 Cm Download Manager 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.
CVE-2020-24141 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2024-11-21 5.3 Medium
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
CVE-2020-24138 1 Wcms 1 Wcms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php.
CVE-2020-24135 1 Wcms 1 Wcms 2024-11-21 6.1 Medium
A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Wcms 0.3.2, which allows remote attackers to inject arbitrary web script and HTML via the type parameter to wex/cssjs.php.
CVE-2020-24075 1 Laborator 1 Kalium 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Name Input Field in Contact Us form in Laborator Kalium before 3.0.4, allows remote attackers to execute arbitrary code.
CVE-2020-24052 1 Moog 4 Exvf5c-2, Exvf5c-2 Firmware, Exvp7c2-3 and 1 more 2024-11-21 9.1 Critical
Several XML External Entity (XXE) vulnerabilities in the Moog EXO Series EXVF5C-2 and EXVP7C2-3 units allow remote unauthenticated users to read arbitrary files via a crafted Document Type Definition (DTD) in an XML request.
CVE-2020-24036 1 Fork-cms 1 Fork Cms 2024-11-21 8.8 High
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code.
CVE-2020-24033 1 Fs 2 S3900 24t4s, S3900 24t4s Firmware 2024-11-21 8.8 High
An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge requests on behalf of a site administrator to change all settings including deleting users, creating new users with escalated privileges.