Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (370024 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-45467 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 9.8 Critical
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.
CVE-2023-45466 1 Netis-systems 2 N3m, N3mv2 Firmware 2024-11-21 9.8 Critical
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.
CVE-2023-45465 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 9.8 Critical
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.
CVE-2023-45464 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 7.5 High
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2023-45463 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 7.5 High
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2023-45396 1 Elenos 3 Etg150, Etg150 Firmware, Etg150 Fm 2024-11-21 6.5 Medium
An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12.
CVE-2023-45394 1 Small Crm Project 1 Small Crm 2024-11-21 5.4 Medium
Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover.
CVE-2023-45393 1 Grandingteco 1 Utime Master 2024-11-21 6.5 Medium
An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie.
CVE-2023-45391 1 Grandingteco 1 Utime Master 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVE-2023-45387 1 Myprestamodules 1 Exportproducts 2024-11-21 9.8 Critical
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().`
CVE-2023-45386 1 Mypresta 1 Product Extra Tabs Pro 2024-11-21 9.8 Critical
In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufacturer().'
CVE-2023-45384 1 Knowband 1 Supercheckout 2024-11-21 9.8 Critical
KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .php
CVE-2023-45383 1 Common-services 1 Sonice Etiquetage 2024-11-21 7.5 High
In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
CVE-2023-45382 2 Common-services, Sonice Retour 2 Sonice Retour, Common Services For Prestashop 2024-11-21 7.5 High
In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
CVE-2023-45381 1 Webshopworks 1 Creativepopup 2024-11-21 9.8 Critical
In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via `cp_download_popup().`
CVE-2023-45380 1 Silbersaiten 1 Order Duplicator 2024-11-21 9.1 Critical
In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.
CVE-2023-45378 1 Hdclic 1 Prestablog 2024-11-21 9.8 Critical
In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_positions.php has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVE-2023-45376 1 Hipresta 1 Carousels Pack 2024-11-21 9.8 Critical
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`
CVE-2023-45375 1 01generator 1 Pireospay 2024-11-21 8.8 High
In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`
CVE-2023-45374 1 Mediawiki 1 Mediawiki 2024-11-21 5.3 Medium
An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.