Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (359063 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-23896 1 Admidio 1 Admidio 2024-11-21 5.4 Medium
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
CVE-2022-23889 1 Yzmcms 1 Yzmcms 2024-11-21 5.3 Medium
The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
CVE-2022-23888 1 Yzmcms 1 Yzmcms 2024-11-21 8.8 High
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
CVE-2022-23887 1 Yzmcms 1 Yzmcms 2024-11-21 6.5 Medium
YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.
CVE-2022-23884 1 Minecraft 1 Bedrock Server 2024-11-21 9.8 Critical
Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer).
CVE-2022-23882 1 Tuzicms 1 Tuzicms 2024-11-21 9.8 Critical
TuziCMS 2.0.6 is affected by SQL injection in \App\Manage\Controller\BannerController.class.php.
CVE-2022-23881 1 Zzzcms 1 Zzzphp 2024-11-21 9.8 Critical
ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
CVE-2022-23880 1 Taogogo 1 Taocms 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-23878 1 Seacms 1 Seacms 2024-11-21 9.8 Critical
seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.
CVE-2022-23873 1 Victor Cms Project 1 Victor Cms 2024-11-21 8.8 High
Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.
CVE-2022-23872 1 Emlog 1 Emlog 2024-11-21 4.8 Medium
Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info.
CVE-2022-23871 1 Gibbonedu 1 Gibbon 2024-11-21 5.4 Medium
Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters.
CVE-2022-23869 1 Ruoyi 1 Ruoyi 2024-11-21 6.5 Medium
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
CVE-2022-23868 1 Ruoyi 1 Ruoyi 2024-11-21 7.8 High
RuoYi v4.7.2 contains a CSV injection vulnerability through ruoyi-admin when a victim opens .xlsx log file.
CVE-2022-23865 1 Wecul 1 Nyron 2024-11-21 9.8 Critical
Nyron 1.0 is affected by a SQL injection vulnerability through Nyron/Library/Catalog/winlibsrch.aspx. To exploit this vulnerability, an attacker must inject '"> on the thes1 parameter.
CVE-2022-23863 1 Zohocorp 1 Manageengine Desktop Central 2024-11-21 6.5 Medium
Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password.
CVE-2022-23858 1 Starwindsoftware 1 Command Center 2024-11-21 8.8 High
A flaw was found in the REST API. An improperly handled REST API call could allow any logged user to elevate privileges up to the system account. This affects StarWind Command Center build 6003 v2.
CVE-2022-23857 1 Navidrome 1 Navidrome 2024-11-21 6.5 Medium
model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
CVE-2022-23856 1 Saviynt 1 Enterprise Identity Cloud 2024-11-21 5.3 Medium
An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An attacker can enumerate users by changing the id parameter, such as for the ECM/maintenance/forgotpasswordstep1 URI.
CVE-2022-23855 1 Saviynt 1 Enterprise Identity Cloud 2024-11-21 9.8 Critical
An issue was discovered in Saviynt Enterprise Identity Cloud (EIC) 5.5 SP2.x. An authentication bypass in ECM/maintenance/forgotpasswordstep1 allows an unauthenticated user to reset passwords and login as any local account.