Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (327112 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-42225 1 Zucchetti 1 Helpdeskadvanced 2025-04-17 7.5 High
Pat Infinite Solutions HelpdeskAdvanced <= 11.0.33 is vulnerable to Directory Traversal via the Attachment/DownloadTempFile function.
CVE-2022-41961 1 Bigbluebutton 1 Bigbluebutton 2025-04-17 4.3 Medium
BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered users from the same extId. This issue has been fixed by improving permissions such that banning a user removes all users related to their extId, including registered users that have not joined the meeting. This issue is patched in versions 2.4-rc-6 and 2.5-alpha-1. There are no workarounds.
CVE-2024-25517 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtility/MF.aspx.
CVE-2024-25518 1 Ruvar 1 Ruvaroa 2025-04-17 9.4 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /WorkFlow/wf_get_fields_approve.aspx.
CVE-2024-25519 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow/wf_work_print.aspx.
CVE-2024-25520 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sys_blogtemplate_new.aspx.
CVE-2024-25521 1 Ruvar 1 Ruvaroa 2025-04-17 9.4 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_company.aspx.
CVE-2024-0341 1 Inis Project 1 Inis 2025-04-17 3.5 Low
A vulnerability was found in Inis up to 2.0.1. It has been rated as problematic. This issue affects some unknown processing of the file /app/api/controller/default/File.php of the component GET Request Handler. The manipulation of the argument path leads to path traversal: '../filedir'. The exploit has been disclosed to the public and may be used. The identifier VDB-250109 was assigned to this vulnerability.
CVE-2024-25522 1 Ruvar 1 Ruvaroa 2025-04-17 9.4 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter at /WorkFlow/wf_work_form_save.aspx.
CVE-2024-25523 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /filemanage/file_memo.aspx.
CVE-2024-25524 1 Ruvar 1 Ruvaroa 2025-04-17 9.4 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkPlan/WorkPlanAttachDownLoad.aspx.
CVE-2024-0345 1 Vehicle Booking System Project 1 Vehicle Booking System 2025-04-17 4.3 Medium
A vulnerability, which was classified as problematic, was found in CodeAstro Vehicle Booking System 1.0. This affects an unknown part of the file usr/usr-register.php of the component User Registration. The manipulation of the argument Full_Name/Last_Name/Address with the input <script>alert(document.cookie)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250113 was assigned to this vulnerability.
CVE-2024-25525 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFlow/OfficeFileDownload.aspx.
CVE-2024-25526 1 Ruvar 1 Ruvaroa 2025-04-17 8.1 High
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the project_id parameter at /ProjectManage/pm_gatt_inc.aspx.
CVE-2024-25527 1 Ruvar 2 Ruvaroa, Ruvaroa 2025-04-17 9.4 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.
CVE-2024-0349 1 Engineers Online Portal Project 1 Engineers Online Portal 2025-04-17 3.7 Low
A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to sensitive cookie without secure attribute. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier VDB-250117 was assigned to this vulnerability.
CVE-2024-25529 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_office_file_history_show.aspx.
CVE-2024-25530 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/get_find_condiction.aspx.
CVE-2024-25531 1 Ruvar 1 Ruvaroa 2025-04-17 9.8 Critical
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtility/SearchCondiction.aspx.
CVE-2024-25528 1 Ruvar 1 Ruvaroa 2025-04-17 5.9 Medium
RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffair/worklog_template_show.aspx.