Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (381370 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-31065 2 Munyweki, Sourcecodester 2 Insurance Management System, Insurance Management System 2025-04-03 6.1 Medium
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the City input field.
CVE-2024-31064 1 Munyweki 1 Insurance Management System 2025-04-03 6.1 Medium
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the First Name input field.
CVE-2025-3190 2025-04-03 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2024-31063 1 Munyweki 1 Insurance Management System 2025-04-03 6.4 Medium
Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via the Email input field.
CVE-2023-24028 1 Misp-project 1 Misp 2025-04-03 9.8 Critical
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
CVE-2023-23596 1 Jc21 1 Nginx Proxy Manager 2025-04-03 8.8 High
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.
CVE-2023-23145 1 Gpac 1 Gpac 2025-04-03 7.8 High
GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.
CVE-2023-23144 1 Gpac 1 Gpac 2025-04-03 5.5 Medium
Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.
CVE-2023-23143 1 Gpac 1 Gpac 2025-04-03 7.8 High
Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c. GPAC version 2.3-DEV-rev1-g4669ba229-master.
CVE-2023-23024 1 Book Store Management System Project 1 Book Store Management System 2025-04-03 6.1 Medium
Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the writer parameter.
CVE-2023-23015 1 Kalkun Project 1 Kalkun 2025-04-03 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.
CVE-2023-23014 1 Inventory System Project 1 Inventory System 2025-04-03 6.1 Medium
Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_store_name and edit_active inputs in file InventorySystem.php.
CVE-2023-23012 1 Classroombookings 1 Classroombookings 2025-04-03 6.1 Medium
Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecified impacts via the input bgcol in file Weeks.php.
CVE-2023-23010 1 Ecommerce-codeigniter-bootstrap Project 1 Ecommerce-codeigniter-bootstrap 2025-04-03 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27, 2022), allows attackers to execute arbitrary code via the languages and trans_load parameters in file add_product.php.
CVE-2023-22964 1 Zohocorp 1 Manageengine Servicedesk Plus Msp 2025-04-03 9.1 Critical
Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication is enabled.
CVE-2023-22617 1 Powerdns 1 Recursor 2025-04-03 7.5 High
A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misconfigured domain, because QName minimization is used in QM fallback mode. This is fixed in 4.8.1.
CVE-2022-46639 1 Correos 1 Correos 2025-04-03 7.5 High
A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
CVE-2022-41505 1 Tp-link 2 Tapo C200 V1, Tapo C200 V1 Firmware 2025-04-03 6.4 Medium
An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interrupting the boot process, and setting an init=/bin/sh value.
CVE-2022-40034 1 Javaweb Blog Project 1 Javaweb Blog 2025-04-03 5.4 Medium
Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter.
CVE-2022-38725 1 Oneidentity 2 Syslog-ng, Syslog-ng Store Box 2025-04-03 7.5 High
An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.