Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2023-4676

XSS in Yordams MedasPro

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yordam MedasPro allows Reflected XSS. This issue affects MedasPro: before 28.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yordam
Products
Medaspro
CVE-2023-4737

SQLi in Hedef Trackings Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hedef Tracking Admin Panel allows SQL Injection. This issue affects Admin Panel: before 1.2.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Hedeftakip
Products
Admin Portal
CVE-2023-4766

SQLi in Movus Admin Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Movus allows SQL Injection. This issue affects Movus: before 20230913.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Movus
Products
Movus
CVE-2023-4830

SQLi in Tura's Signalix

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tura Signalix allows SQL Injection. This issue affects Signalix: 7T_0228.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Turaconsulting
Products
Signalix
CVE-2023-4832

SQLi in Aceka Holdings Company Management

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aceka Company Management allows SQL Injection. This issue affects Company Management: before 3072 .

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Acekaholding
Products
Company Management
CVE-2023-4833

SQLi in Besttem's Network Marketing Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Besttem Network Marketing Software allows SQL Injection. This issue affects Network Marketing Software: before 1.0.2309.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Besttem Network Marketing Project
Products
Besttem Network Marketing
CVE-2026-9102

Path Traversal in Altium Enterprise Server ComparisonService Allows Arbitrary File Write

A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitization in the Gerber file upload APIs. A regular authenticated workspace user can supply a crafted filename in the multipart Content-Disposition header to escape the intended temporary upload directory and write arbitrary files to any location on the server filesystem. Because content-controlled files can be written to web-accessible directories, this can be escalated to remote code execution in the context of the service account. It can also be used to overwrite application binaries or configuration files, leading to service takeover or denial of service.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Altium
Products
On-prem Enterprise Server
CVE-2026-9129

Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path (such as an encoded drive letter) in a Viewer storage API request, causing the configured storage root to be discarded and allowing arbitrary files to be read from the server filesystem. Because the readable files include the server's master configuration, which stores database credentials, signing key locations, certificate passwords, and OAuth secrets, exploitation can lead to disclosure of all server secrets and full compromise of the server and its data. Cloud deployments are not affected, as they use object storage and do not enable this component.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Altium
Products
On-prem Enterprise Server
CVE-2023-4934

IDOR in Usta AYBS

Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: before 1.0.3.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Usta
Products
Aybs
CVE-2023-4972

Information Disclosure in Digital Yepas

Incorrect Use of Privileged APIs vulnerability in Yepas Digital Yepas allows Collect Data as Provided by Users. This issue affects Digital Yepas: before 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Yepas
Products
Digital Yepas
CVE-2023-4702

Authentication Bypass in Digital Yepas

Authentication Bypass Using an Alternate Path or Channel vulnerability in Yepas Digital Yepas allows Authentication Bypass. This issue affects Digital Yepas: before 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Yepas
Products
Digital Yepas
CVE-2023-5045

SQLi in Biltay's Kayısı

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Kayisi: before 1286.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Biltay
Products
Kayisi
CVE-2023-5046

SQLi in Biltay's Procost

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Biltay
Products
Procost
CVE-2023-5047

SQLi in DRDrive

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection. This issue affects DRDrive: before 20231006.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Drd
Products
Drdrive
CVE-2023-5443

User Enumeration in EDM Informatic's E-Invoice Software

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E-invoice: before 2.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
E-invoice Project Edm Informatics
Products
E-invoice E-invoice
CVE-2023-5570

User Enumeration in Inohom's Home Manager Gateway

Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects Home Manager Gateway: before v.1.27.12.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Inohom
Products
Home Manager Gateway
CVE-2026-32740

libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in the grid tile compositing, allowing an attacker to write 64 bytes of fully attacker-controlled data past the end of a chroma plane heap allocation by crafting a HEIF/AVIF file with a 1×4 grid of odd-height tiles. The overflow is triggered during normal image decoding with default build configuration. The written bytes are chroma (Cb/Cr) pixel values from the attacking tile, giving the attacker full control over the overflow content. This issue has been fixed in version 1.22.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Struktur
Products
Libheif