Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (118519 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-18886 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
Unrestricted File Upload in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the component 'admin/upload_file_do.php'.
CVE-2020-18885 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
CVE-2020-18879 1 Bludit 1 Bludit 2024-11-21 9.8 Critical
Unrestricted File Upload in Bludit v3.8.1 allows remote attackers to execute arbitrary code by uploading malicious files via the component 'bl-kereln/ajax/upload-logo.php'.
CVE-2020-18878 1 Skycaiji 1 Skycaiji 2024-11-21 5.3 Medium
Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'.
CVE-2020-18877 1 Wuzhicms 1 Wuzhicms 2024-11-21 7.5 High
SQL Injection in Wuzhi CMS v4.1.0 allows remote attackers to obtain sensitive information via the 'flag' parameter in the component '/coreframe/app/order/admin/index.php'.
CVE-2020-18875 1 Dotcms 1 Dotcms 2024-11-21 8.8 High
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.
CVE-2020-18831 1 Exiv2 1 Exiv2 2024-11-21 7.8 High
Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.
CVE-2020-18766 1 Antsword Project 1 Antsword 2024-11-21 9.6 Critical
A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands.
CVE-2020-18746 1 Aitecms 1 Aitecms 2024-11-21 7.2 High
SQL Injection in AiteCMS v1.0 allows remote attackers to execute arbitrary code via the component "aitecms/login/diy_list.php".
CVE-2020-18741 1 Thinksaas 1 Thinksaas 2024-11-21 5.3 Medium
Improper Authorization in ThinkSAAS v2.7 allows remote attackers to modify the description of any user's photo via the "photoid%5B%5D" and "photodesc%5B%5D" parameters in the component "index.php?app=photo."
CVE-2020-18737 1 Typora 1 Typora 2024-11-21 6.1 Medium
An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.
CVE-2020-18717 1 Zzzcms 1 Zzzphp 2024-11-21 9.8 Critical
SQL Injection in ZZZCMS zzzphp 1.7.1 allows remote attackers to execute arbitrary code due to a lack of parameter filtering in inc/zzz_template.php.
CVE-2020-18716 1 Rockoa 1 Rockoa 2024-11-21 9.8 Critical
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordAction.php.
CVE-2020-18714 1 Rockoa 1 Rockoa 2024-11-21 9.8 Critical
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in wordModel.php's getdata function.
CVE-2020-18713 1 Rockoa 1 Rockoa 2024-11-21 9.8 Critical
SQL Injection in Rockoa v1.8.7 allows remote attackers to gain privileges due to loose filtering of parameters in customerAction.php
CVE-2020-18705 1 Quokka Project 1 Quokka 2024-11-21 9.8 Critical
XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'.
CVE-2020-18704 1 Fusionbox 1 Widgy 2024-11-21 9.8 Critical
Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page'.
CVE-2020-18703 1 Quokka Project 1 Quokka 2024-11-21 9.8 Critical
XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.
CVE-2020-18702 1 Quokka Project 1 Quokka 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'.
CVE-2020-18701 1 Talelin 1 Lin-cms-flask 2024-11-21 9.8 Critical
Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets.