Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (372303 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-25895 1 Churchcrm 1 Churchcrm 2025-03-17 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter of /EventAttendance.php
CVE-2024-25894 1 Churchcrm 1 Churchcrm 2025-03-17 9.8 Critical
ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter.
CVE-2024-25893 1 Churchcrm 1 Churchcrm 2025-03-17 9.1 Critical
ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
CVE-2024-25892 1 Churchcrm 1 Churchcrm 2025-03-17 8.1 High
ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter.
CVE-2024-46550 1 Draytek 2 Vigor3910, Vigor3910 Firmware 2025-03-17 7.5 High
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the CGIbyFieldName parameter at chglog.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2023-42948 1 Apple 1 Macos 2025-03-17 3.3 Low
This issue was addressed through improved state management. This issue is fixed in macOS Sonoma 14. A Wi-Fi password may not be deleted when activating a Mac in macOS Recovery.
CVE-2023-35859 1 Moderncampus 1 Omni Cms 2025-03-17 6.1 Medium
A Reflected Cross-Site Scripting (XSS) vulnerability in the blog function of Modern Campus - Omni CMS 2023.1 allows a remote attacker to inject arbitrary scripts or HTML via multiple parameters.
CVE-2023-26235 1 Jd-gui Project 1 Jd-gui 2025-03-17 6.1 Medium
JD-GUI 1.6.6 allows XSS via util/net/InterProcessCommunicationUtil.java.
CVE-2023-26234 1 Jd-gui Project 1 Jd-gui 2025-03-17 6.6 Medium
JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.
CVE-2023-26093 1 Puzzle 1 Liima 2025-03-17 9.8 Critical
Liima before 1.17.28 allows Hibernate query language (HQL) injection, related to colToSort in the deployment filter.
CVE-2023-26092 1 Puzzle 1 Liima 2025-03-17 9.8 Critical
Liima before 1.17.28 allows server-side template injection.
CVE-2023-23296 1 Korenix 29 Jetwave 2111, Jetwave 2111 Firmware, Jetwave 2111l and 26 more 2025-03-17 6.5 Medium
Korenix JetWave 4200 Series 1.3.0 and JetWave 3200 Series 1.6.0 are vulnerable to Denial of Service via /goform/formDefault.
CVE-2023-23295 1 Korenix 29 Jetwave 2111, Jetwave 2111 Firmware, Jetwave 2111l and 26 more 2025-03-17 8.8 High
Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
CVE-2023-21017 1 Google 1 Android 2025-03-17 7.8 High
In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-236687884
CVE-2023-21016 1 Google 1 Android 2025-03-17 5.5 Medium
In AccountTypePreference of AccountTypePreference.java, there is a possible way to mislead the user about accounts installed on the device due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-213905884
CVE-2023-21015 1 Google 1 Android 2025-03-17 7.8 High
In getAvailabilityStatus of several Transcode Permission Controllers, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-244569778
CVE-2023-20858 2 Microsoft, Vmware 2 Windows, Carbon Black App Control 2025-03-17 7.2 High
VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. A malicious actor with privileged access to the App Control administration console may be able to use specially crafted input allowing access to the underlying server operating system.
CVE-2023-20855 1 Vmware 2 Vrealize Automation, Vrealize Orchestrator 2025-03-17 8.8 High
VMware vRealize Orchestrator contains an XML External Entity (XXE) vulnerability. A malicious actor, with non-administrative access to vRealize Orchestrator, may be able to use specially crafted input to bypass XML parsing restrictions leading to access to sensitive information or possible escalation of privileges.
CVE-2023-20662 4 Google, Linux, Mediatek and 1 more 29 Android, Linux Kernel, Mt5221 and 26 more 2025-03-17 6.7 Medium
In wlan, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560765; Issue ID: ALPS07560765.
CVE-2023-20661 4 Google, Linux, Mediatek and 1 more 29 Android, Linux Kernel, Mt5221 and 26 more 2025-03-17 6.7 Medium
In wlan, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560782; Issue ID: ALPS07560782.