Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (371461 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-29420 1 Bzip3 Project 1 Bzip3 2025-03-05 6.5 Medium
An issue was discovered in libbzip3.a in bzip3 before 1.2.3. There is a crash caused by an invalid memmove in bz3_decode_block.
CVE-2023-27088 1 Feiqu-opensource Project 1 Feiqu-opensource 2025-03-05 8.8 High
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will.
CVE-2023-26957 1 Onekeyadmin 1 Onekeyadmin 2025-03-05 9.1 Critical
onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.
CVE-2023-26956 1 Onekeyadmin 1 Onekeyadmin 2025-03-05 7.5 High
onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
CVE-2023-26950 1 Onekeyadmin 1 Onekeyadmin 2025-03-05 5.4 Medium
onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.
CVE-2023-26261 1 Ubikasec 2 Waap Cloud, Waap Gateway 2025-03-05 9.8 Critical
In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another connected user. The fixed versions are WAAP Gateway & Cloud 6.11.0 and 6.5.6-patch15.
CVE-2023-24782 1 Funadmin 1 Funadmin 2025-03-05 9.8 Critical
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
CVE-2023-24777 1 Funadmin 1 Funadmin 2025-03-05 9.8 Critical
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
CVE-2023-24773 1 Funadmin 1 Funadmin 2025-03-05 9.8 Critical
Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
CVE-2023-24657 1 Phpipam 1 Phpipam 2025-03-05 6.1 Medium
phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/popup.php.
CVE-2023-24282 1 Poly 2 Trio 8800, Trio 8800 Firmware 2025-03-05 5.4 Medium
An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file.
CVE-2023-20650 2 Google, Mediatek 14 Android, Mt6853, Mt6853t and 11 more 2025-03-05 6.7 Medium
In apu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07629577; Issue ID: ALPS07629577.
CVE-2023-20649 2 Google, Mediatek 37 Android, Mt6761, Mt6762 and 34 more 2025-03-05 4.4 Medium
In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628607; Issue ID: ALPS07628607.
CVE-2023-20648 2 Google, Mediatek 38 Android, Mt6761, Mt6762 and 35 more 2025-03-05 4.4 Medium
In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628612; Issue ID: ALPS07628612.
CVE-2023-26328 3 Adobe, Apple, Microsoft 3 Dimension, Macos, Windows 2025-03-05 7.8 High
Adobe Dimension versions 3.4.7 (and earlier) is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-20647 2 Google, Mediatek 33 Android, Mt6739, Mt6761 and 30 more 2025-03-05 4.4 Medium
In ril, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628547; Issue ID: ALPS07628547.
CVE-2023-20635 2 Google, Mediatek 52 Android, Mt6580, Mt6731 and 49 more 2025-03-05 4.4 Medium
In keyinstall, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07563028; Issue ID: ALPS07563028.
CVE-2023-1325 1 Yikesinc 1 Easy Forms For Mailchimp 2025-03-05 5.4 Medium
The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2023-0765 1 Bestwebsoft 1 Gallery 2025-03-05 8.8 High
The Gallery by BestWebSoft WordPress plugin before 4.7.0 does not properly escape values used in SQL queries, leading to an Blind SQL Injection vulnerability. The attacker must have at least the privileges of an Author, and the vendor's Slider plugin (https://wordpress.org/plugins/slider-bws/) must also be installed for this vulnerability to be exploitable.
CVE-2021-41613 1 Openrisc 2 Mor1kx, Mor1kx Firmware 2025-03-05 4.3 Medium
An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EEAR) is not implemented correctly. User programs from authorized privilege levels will be unable to write to EEAR.