Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (370019 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-25305 1 Polymc 1 Polymc 2025-02-13 7.1 High
PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.
CVE-2023-25303 1 Atlauncher 1 Atlauncher 2025-02-13 7.1 High
ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal. A mrpack file can be maliciously crafted to create arbitrary files outside of the installation directory.
CVE-2023-20663 4 Google, Linux, Mediatek and 1 more 29 Android, Linux Kernel, Mt5221 and 26 more 2025-02-13 6.7 Medium
In wlan, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07560741; Issue ID: ALPS07560741.
CVE-2023-20653 2 Google, Mediatek 60 Android, Mt6580, Mt6731 and 57 more 2025-02-13 6.7 Medium
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628168; Issue ID: ALPS07589144.
CVE-2023-20652 2 Google, Mediatek 60 Android, Mt6580, Mt6731 and 57 more 2025-02-13 6.7 Medium
In keyinstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07628168; Issue ID: ALPS07589135.
CVE-2023-0738 1 Orangescrum 1 Orangescrum 2025-02-13 6.1 Medium
OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. This is possible because the application returns malicious user input in the response with the content-type set to text/html.
CVE-2015-9457 1 Caseproof 1 Prettylinks 2025-02-13 7.2 High
The pretty-link plugin before 1.6.8 for WordPress has PrliLinksController::list_links SQL injection via the group parameter.
CVE-2011-4595 1 Caseproof 1 Prettylinks 2025-02-13 6.1 Medium
Pretty-Link WordPress plugin 1.5.2 has XSS
CVE-2024-2362 3 Linux, Lollms, Microsoft 3 Linux Kernel, Lollms Web Ui, Windows 2025-02-13 9.1 Critical
A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of adequate sanitization of user-supplied input in the 'del_preset' endpoint, where the application fails to prevent the use of absolute paths or directory traversal sequences ('..'). As a result, an attacker can send a specially crafted request to the 'del_preset' endpoint to delete files outside of the intended directory.
CVE-2024-37273 2 Homebrew, Jan 2 Jan, Jan 2025-02-13 9.8 Critical
An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-36858 1 Homebrew 1 Jan 2025-02-13 9.8 Critical
An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-36857 2 Homebrew, Janhq 2 Jan, Jan 2025-02-13 7.5 High
Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.
CVE-2024-36788 1 Netgear 2 Wnr614, Wnr614 Firmware 2025-02-13 5.9 Medium
Netgear WNR614 JNR1010V2 N300-V1.1.0.54_1.0.1 does not properly set the HTTPOnly flag for cookies. This allows attackers to possibly intercept and access sensitive communications between the router and connected devices.
CVE-2024-36779 1 Stock Management System Project 1 Stock Management System 2025-02-13 9.8 Critical
Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.
CVE-2024-36775 1 Monstra 2 Monstra, Monstra Cms 2025-02-13 4.7 Medium
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the About Me parameter in the Edit Profile page.
CVE-2024-36774 1 Monstra 1 Monstra 2025-02-13 7.2 High
An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2024-36773 1 Monstra 2 Monstra, Monstra Cms 2025-02-13 4.8 Medium
A cross-site scripting (XSS) vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Themes parameter at index.php.
CVE-2024-36675 1 Lylme 1 Lylme Spage 2025-02-13 9.1 Critical
LyLme_spage v1.9.5 is vulnerable to Server-Side Request Forgery (SSRF) via the get_head function.
CVE-2024-36673 1 Pharmacy\/medical Store Point Of Sale System Project 1 Pharmacy\/medical Store Point Of Sale System 2025-02-13 9.8 Critical
Sourcecodester Pharmacy/Medical Store Point of Sale System 1.0 is vulnerable SQL Injection via login.php. This vulnerability stems from inadequate validation of user inputs for the email and password parameters, allowing attackers to inject malicious SQL queries.
CVE-2024-36669 1 Idccms Project 1 Idccms 2025-02-13 5.4 Medium
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component admin/type_deal.php?mudi=add.