Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (372509 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-21939 1 Johnsoncontrols 1 Metasys System Configuration Tool 2025-03-24 7.5 High
Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
CVE-2024-7976 1 Google 1 Chrome 2025-03-24 4.3 Medium
Inappropriate implementation in FedCM in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE-2024-57031 1 Wegia 1 Wegia 2025-03-24 9.8 Critical
WeGIA < 3.2.0 is vulnerable to SQL Injection in /funcionario/remuneracao.php via the id_funcionario parameter.
CVE-2024-24418 1 Linuxfoundation 1 Magma 2025-03-24 7.5 High
The Linux Foundation Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) was discovered to contain a buffer overflow in the decode_pdn_address function at /nas/ies/PdnAddress.cpp. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.
CVE-2023-5355 1 Getawesomesupport 1 Awesome Support 2025-03-24 8.1 High
The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete arbitrary files on the server.
CVE-2023-37034 1 Linuxfoundation 1 Magma 2025-03-24 6.5 Medium
A Null pointer dereference vulnerability in the Mobile Management Entity (MME) in Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows network-adjacent attackers to crash the MME via an S1AP `Initial UE Message` packet missing an expected `TAI` field.
CVE-2023-24234 1 Inventory Management System Project 1 Inventory Management System 2025-03-24 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Brand Name parameter.
CVE-2023-24233 1 Inventory Management System Project 1 Inventory Management System 2025-03-24 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Client Name parameter.
CVE-2023-24232 1 Inventory Management System Project 1 Inventory Management System 2025-03-24 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter.
CVE-2023-24231 1 Inventory Management System Project 1 Inventory Management System 2025-03-24 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Categories Name parameter.
CVE-2023-24230 1 Formwork Project 1 Formwork 2025-03-24 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter.
CVE-2022-48077 1 Genymotion 1 Genymotion Desktop 2025-03-24 7.8 High
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
CVE-2022-45766 1 Keystorage 1 Global Facilities Management Software 2025-03-24 9.1 Critical
Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impact availability, confidentiality, accessibility and dependability of electronic key boxes.
CVE-2022-45725 1 Comfast 2 Cf-wr610n, Cf-wr610n Firmware 2025-03-24 8.8 High
Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP POST request
CVE-2022-45724 1 Comfast 2 Cf-wr610n, Cf-wr610n Firmware 2025-03-24 5.4 Medium
Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated page to force the server to generate a SESSION_ID, and using this SESSION_ID an attacker can then perform authenticated requests.
CVE-2022-45285 1 Vsourz 1 Advanced Cf7 Db 2025-03-24 6.1 Medium
Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44261 1 Averydennison 2 Monarch Printer M9855, Monarch Printer M9855 Firmware 2025-03-24 6.1 Medium
Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-43501 1 Elwsc 4 Kasago Ipv4, Kasago Ipv4 Light, Kasago Ipv6\/v4 Dual and 1 more 2025-03-24 9.1 Critical
KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random source. An attacker may be able to determine the ISN of the current or future TCP connections and either hijack existing ones or spoof future ones.
CVE-2023-0759 1 Agentejo 1 Cockpit 2025-03-24 8.8 High
Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
CVE-2022-21940 1 Johnsoncontrols 1 Metasys System Configuration Tool 2025-03-24 7.5 High
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.