Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (330990 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-21012 1 Hotel And Lodge Booking Management System Project 1 Hotel And Lodge Booking Management System 2024-11-21 9.8 Critical
Sourcecodester Hotel and Lodge Management System 2.0 is vulnerable to unauthenticated SQL injection and can allow remote attackers to execute arbitrary SQL commands via the email parameter to the edit page for Customer, Room, Currency, Room Booking Details, or Tax Details.
CVE-2020-21005 1 Wellcms 1 Wellcms 2024-11-21 6.5 Medium
WellCMS 2.0 beta3 is vulnerable to File Upload. A user can log in to the CMS background and upload a picture. Because the upload file type is controllable, the user can modify the upload file type to get webshell.
CVE-2020-21003 1 Pbootcms 1 Pbootcms 2024-11-21 4.8 Medium
Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.
CVE-2020-20990 1 Domainmod 1 Domainmod 2024-11-21 5.4 Medium
A cross site scripting (XSS) vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter.
CVE-2020-20989 1 Domainmod 1 Domainmod 2024-11-21 4.3 Medium
A cross-site request forgery (CSRF) in /admin/maintenance/ of Domainmod 4.13 allows attackers to arbitrarily delete logs.
CVE-2020-20988 1 Domainmod 1 Domainmod 2024-11-21 5.4 Medium
A cross site scripting (XSS) vulnerability in the /domains/cost-by-owner.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the "or Expiring Between" parameter.
CVE-2020-20982 1 Wdja 1 Wdja Cms 2024-11-21 9.6 Critical
Cross Site Scripting (XSS) vulnerability in shadoweb wdja v1.5.1, allows attackers to execute arbitrary code and gain escalated privileges, via the backurl parameter to /php/passport/index.php.
CVE-2020-20981 1 Metinfo 1 Metinfo 2024-11-21 7.5 High
A SQL injection in the /admin/?n=logs&c=index&a=dolist component of Metinfo 7.0 allows attackers to access sensitive database information.
CVE-2020-20979 1 8cms 1 Ljcms 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the move_uploaded_file() function of LJCMS v4.3 allows attackers to execute arbitrary code.
CVE-2020-20977 1 Ukcms 1 Ukcms 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section.
CVE-2020-20975 1 Gxlcms 1 Gxlcms 2024-11-21 9.8 Critical
In \lib\admin\action\dataaction.class.php in Gxlcms v1.1, SQL Injection exists via the $filename parameter.
CVE-2020-20971 1 Pbootcms 1 Pbootcms 2024-11-21 8.8 High
Cross Site Request Forgery (CSRF) vulnerability in PbootCMS v2.0.3 via /admin.php?p=/User/index.
CVE-2020-20951 1 Pluck-cms 1 Pluck 2024-11-21 9.8 Critical
In Pluck-4.7.10-dev2 admin background, a remote command execution vulnerability exists when uploading files.
CVE-2020-20950 5 Apple, Ietf, Linux and 2 more 5 Macos, Public Key Cryptography Standards \#1, Linux Kernel and 2 more 2024-11-21 5.9 Medium
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in Microchip Libraries for Applications 2018-11-26 All up to 2018-11-26. The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
CVE-2020-20949 2 Ietf, St 22 Public Key Cryptography Standards \#1, Stm32cubef0, Stm32cubef1 and 19 more 2024-11-21 5.9 Medium
Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.
CVE-2020-20948 1 Jeecg 1 Jeecg 2024-11-21 7.5 High
An arbitrary file download vulnerability in jeecg v3.8 allows attackers to access sensitive files via modification of the "localPath" variable.
CVE-2020-20946 1 Qibosoft 1 Qibosoft 2024-11-21 5.4 Medium
Qibosoft v7 contains a stored cross-site scripting (XSS) vulnerability in the component /admin/index.php?lfj=friendlink&action=add.
CVE-2020-20945 1 Qibosoft 1 Qibosoft 2024-11-21 8.8 High
A Cross-Site Request Forgery (CSRF) in /admin/index.php?lfj=member&action=editmember of Qibosoft v7 allows attackers to arbitrarily add administrator accounts.
CVE-2020-20944 1 Qibosoft 1 Qibosoft 2024-11-21 9.1 Critical
An issue in /admin/index.php?lfj=mysql&action=del of Qibosoft v7 allows attackers to arbitrarily delete files.
CVE-2020-20943 1 Qibosoft 1 Qibosoft 2024-11-21 4.3 Medium
A Cross-Site Request Forgery (CSRF) in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL.