Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357188 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-23923 1 Jailed Project 1 Jailed 2024-11-21 8.6 High
All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
CVE-2022-23916 1 Appleple 1 A-blog Cms 2024-11-21 6.1 Medium
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-24374.
CVE-2022-23915 1 Weblate 1 Weblate 2024-11-21 7.2 High
The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
CVE-2022-23913 3 Apache, Netapp, Redhat 9 Activemq Artemis, Active Iq Unified Manager, Oncommand Workflow Automation and 6 more 2024-11-21 7.5 High
In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
CVE-2022-23912 1 Accesspressthemes 1 Ap Custom Testimonial 2024-11-21 6.1 Medium
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
CVE-2022-23911 1 Accesspressthemes 1 Ap Custom Testimonial 2024-11-21 7.2 High
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
CVE-2022-23909 2 Gimmal, Microsoft 2 Sherpa Connector Service, Windows 2024-11-21 7.8 High
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.
CVE-2022-23907 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 6.1 Medium
CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
CVE-2022-23906 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 7.2 High
CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
CVE-2022-23904 1 Rainworx 1 Auctionworx 2024-11-21 8.0 High
Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition.
CVE-2022-23903 1 Pearadmin 1 Pear Admin Think 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent.
CVE-2022-23902 1 Tongda2000 1 Tongda Office Anywhere 2024-11-21 9.8 Critical
Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.
CVE-2022-23901 1 Re2c 1 Re2c 2024-11-21 9.8 Critical
A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
CVE-2022-23900 1 Wavlink 2 Wl-wn531p3, Wl-wn531p3 Firmware 2024-11-21 9.8 Critical
A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.
CVE-2022-23899 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
CVE-2022-23898 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
CVE-2022-23896 1 Admidio 1 Admidio 2024-11-21 5.4 Medium
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
CVE-2022-23889 1 Yzmcms 1 Yzmcms 2024-11-21 5.3 Medium
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
CVE-2022-23888 1 Yzmcms 1 Yzmcms 2024-11-21 8.8 High
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
CVE-2022-23887 1 Yzmcms 1 Yzmcms 2024-11-21 6.5 Medium
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.