Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (364866 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-28023 1 Servicetonic 1 Servicetonic 2024-11-21 9.8 Critical
Arbitrary file upload in Service import feature in ServiceTonic Helpdesk software version < 9.0.35937 allows a malicious user to execute JSP code by uploading a zip that extracts files in relative paths.
CVE-2021-28022 1 Servicetonic 1 Servicetonic 2024-11-21 7.5 High
Blind SQL injection in the login form in ServiceTonic Helpdesk software < 9.0.35937 allows attacker to exfiltrate information via specially crafted HQL-compatible time-based SQL queries.
CVE-2021-28021 3 Debian, Fedoraproject, Stb Project 3 Debian Linux, Fedora, Stb 2024-11-21 7.8 High
Buffer overflow vulnerability in function stbi__extend_receive in stb_image.h in stb 2.26 via a crafted JPEG file.
CVE-2021-28007 1 Web Based Quiz System Project 1 Web Based Quiz System 2024-11-21 6.1 Medium
Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.
CVE-2021-28006 1 Web Based Quiz System Project 1 Web Based Quiz System 2024-11-21 6.1 Medium
Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.
CVE-2021-28002 1 Textpattern 1 Textpattern 2024-11-21 5.4 Medium
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page.
CVE-2021-28001 1 Textpattern 1 Textpattern 2024-11-21 5.4 Medium
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head.
CVE-2021-28000 1 Local Services Search Engine Management System Project 1 Local Services Search Engine Management System 2024-11-21 4.8 Medium
A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to execute arbitrary code via crafted payloads entered into the Name and Address fields.
CVE-2021-27999 1 Local Services Search Engine Management System Project 1 Local Services Search Engine Management System 2024-11-21 4.9 Medium
A SQL injection vulnerability was discovered in the editid parameter in Local Services Search Engine Management System Project 1.0. This vulnerability gives admin users the ability to dump all data from the database.
CVE-2021-27990 1 Appspace 1 Appspace 2024-11-21 7.5 High
Appspace 6.2.4 is vulnerable to a broken authentication mechanism where pages such as /medianet/mail.aspx can be called directly and the framework is exposed with layouts, menus and functionalities.
CVE-2021-27989 1 Appspace 1 Appspace 2024-11-21 5.4 Medium
Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.
CVE-2021-27984 1 Pluck-cms 1 Pluck 2024-11-21 8.1 High
In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files.
CVE-2021-27983 1 Max-3000 1 Maxsite Cms 2024-11-21 9.8 Critical
Remote Code Execution (RCE) vulnerability exists in MaxSite CMS v107.5 via the Documents page.
CVE-2021-27973 1 Piwigo 1 Piwigo 2024-11-21 7.2 High
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages.
CVE-2021-27971 1 Alpsalpine 1 Touchpad Driver 2024-11-21 7.8 High
Alps Alpine Touchpad Driver 10.3201.101.215 is vulnerable to DLL Injection.
CVE-2021-27969 1 Boonex 1 Dolphin 2024-11-21 4.8 Medium
Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter.
CVE-2021-27965 1 Msi 1 Dragon Center 2024-11-21 9.8 Critical
The MsIo64.sys driver before 1.1.19.1016 in MSI Dragon Center before 2.0.98.0 has a buffer overflow that allows privilege escalation via a crafted 0x80102040, 0x80102044, 0x80102050, or 0x80102054 IOCTL request.
CVE-2021-27964 1 Sfcyazilim 1 Sonlogger 2024-11-21 9.8 Critical
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.
CVE-2021-27963 1 Sfcyazilim 1 Sonlogger 2024-11-21 8.2 High
SonLogger before 6.4.1 is affected by user creation with any user permissions profile (e.g., SuperAdmin). An anonymous user can send a POST request to /User/saveUser without any authentication or session header.
CVE-2021-27962 1 Grafana 1 Grafana 2024-11-21 7.1 High
Grafana Enterprise 7.2.x and 7.3.x before 7.3.10 and 7.4.x before 7.4.5 allows a dashboard editor to bypass a permission check concerning a data source they should not be able to access.