Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (373436 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-22721 1 Formtools 1 Form Tools 2025-04-08 6.3 Medium
Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link.
CVE-2024-22719 1 Formtools 1 Form Tools 2025-04-08 8.1 High
SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client.
CVE-2024-22718 1 Formtools 1 Form Tools 2025-04-08 9.6 Critical
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL.
CVE-2024-22717 1 Formtools 1 Form Tools 2025-04-08 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application.
CVE-2024-31678 2 Loan Management System Project, Razormist 2 Loan Management System, Loan Management System 2025-04-08 9.8 Critical
Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file.
CVE-2024-29220 1 Ninjaforms 1 Ninja Forms 2025-04-08 6.1 Medium
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
CVE-2024-26019 1 Ninjaforms 1 Ninja Forms 2025-04-08 5.4 Medium
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
CVE-2024-25572 2 Ninjaforms, Saturday Drive 2 Ninja Forms, Ninja Forms 2025-04-08 8.8 High
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
CVE-2022-46623 1 Judging Management System Project 1 Judging Management System 2025-04-08 7.8 High
Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVE-2022-46622 1 Judging Management System Project 1 Judging Management System 2025-04-08 6.1 Medium
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
CVE-2022-46503 1 Online Student Enrollment System Project 1 Online Student Enrollment System 2025-04-08 5.4 Medium
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter.
CVE-2022-46472 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-08 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete.
CVE-2022-46370 1 Maxum 1 Rumpus 2025-04-08 7.3 High
Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification.
CVE-2022-3628 2 Linux, Redhat 4 Linux Kernel, Enterprise Linux, Rhel Eus and 1 more 2025-04-08 6.6 Medium
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
CVE-2022-25027 1 Rocketsoftware 1 Trufusion Enterprise 2025-04-08 7.5 High
The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.
CVE-2022-25026 1 Rocketsoftware 1 Trufusion Enterprise 2025-04-08 7.5 High
A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy.
CVE-2017-5242 1 Rapid7 1 Insightvm 2025-04-08 7.7 High
Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots.
CVE-2024-25250 1 Carmelo 1 Agro-school Management System 2025-04-08 9.8 Critical
SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code via the Login page.
CVE-2024-28402 1 Totolink 2 X2000r, X2000r Firmware 2025-04-08 5.9 Medium
TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firewall Page.
CVE-2025-3303 1 Code-projects 1 Patient Record Management System 2025-04-08 6.3 Medium
A vulnerability, which was classified as critical, has been found in code-projects Patient Record Management System 1.0. Affected by this issue is some unknown functionality of the file /birthing_record.php. The manipulation of the argument itr_no leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.