Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361539 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-25398 1 Mind 1 Imind Server 2024-11-21 8.8 High
CSV Injection exists in InterMind iMind Server through 3.13.65 via the csv export functionality.
CVE-2020-25394 1 Mozilo 1 Mozilocms 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in moziloCMS 2.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Content" parameter.
CVE-2020-25392 1 Cszcms 1 Csz Cms 2024-11-21 5.4 Medium
A cross site scripting (XSS) vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Article' field under the 'Article' plugin.
CVE-2020-25391 1 Cszcms 1 Csz Cms 2024-11-21 5.4 Medium
A cross site scripting vulnerability in CSZ CMS 1.2.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'New Pages' field under the 'Pages Content' module.
CVE-2020-25385 1 Nagios 1 Log Server 2024-11-21 6.1 Medium
Nagios Log Server 2.1.7 contains a cross-site scripting (XSS) vulnerability in /nagioslogserver/configure/create_snapshot through the snapshot_name parameter, which may impact users who open a maliciously crafted link or third-party web page.
CVE-2020-25380 1 Recall-products Project 1 Recall-products 2024-11-21 5.4 Medium
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.
CVE-2020-25379 1 Recall-products Project 1 Recall-products 2024-11-21 8.8 High
Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 fails to sanitize input from the 'Manufacturer[]' parameter which allows an authenticated attacker to inject a malicious SQL query.
CVE-2020-25378 1 Accesspressthemes 1 Wp Floating Menu 2024-11-21 6.1 Medium
Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.
CVE-2020-25375 1 Softrade 1 Wp Smart Crm \& Invoices 2024-11-21 5.4 Medium
Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
CVE-2020-25374 1 Cyberark 1 Privileged Session Manager 2024-11-21 2.6 Low
CyberArk Privileged Session Manager (PSM) 10.9.0.15 allows attackers to discover internal pathnames by reading an error popup message after two hours of idle time.
CVE-2020-25368 1 Dlink 2 Dir-823g, Dir-823g Firmware 2024-11-21 9.8 Critical
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the PrivateLogin field to Login.
CVE-2020-25367 1 Dlink 2 Dir-823g, Dir-823g Firmware 2024-11-21 9.8 Critical
A command injection vulnerability was discovered in the HNAP1 protocol in D-Link DIR-823G devices with firmware V1.0.2B05. An attacker is able to execute arbitrary web scripts via shell metacharacters in the Captcha field to Login.
CVE-2020-25366 1 Dlink 2 Dir-823g, Dir-823g Firmware 2024-11-21 9.1 Critical
An issue in the component /cgi-bin/upload_firmware.cgi of D-Link DIR-823G REVA1 1.02B05 allows attackers to cause a denial of service (DoS) via unspecified vectors.
CVE-2020-25362 1 Online Shopping Alphaware Project 1 Online Shopping Alphaware 2024-11-21 7.5 High
The id paramater in Online Shopping Alphaware 1.0 has been discovered to be vulnerable to an Error-Based blind SQL injection in the /alphaware/details.php path. This allows an attacker to retrieve all databases.
CVE-2020-25359 1 Rconfig 1 Rconfig 2024-11-21 9.1 Critical
An arbitrary file deletion vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability gave attackers the ability to send a crafted request to /lib/ajaxHandlers/ajaxDeleteAllLoggingFiles.php by specifying a path in the path parameter and an extension in the ext parameter and delete all the files with that extension in that path.
CVE-2020-25353 1 Rconfig 1 Rconfig 2024-11-21 6.5 Medium
A server-side request forgery (SSRF) vulnerability in rConfig 3.9.5 has been fixed for 3.9.6. This vulnerability allowed remote authenticated attackers to open a connection to the machine via the deviceIpAddr and connPort parameters.
CVE-2020-25352 1 Rconfig 1 Rconfig 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the /devices.php function inrConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote attackers to perform arbitrary Javascript execution through entering a crafted payload into the 'Model' field then saving.
CVE-2020-25351 1 Rconfig 1 Rconfig 2024-11-21 6.5 Medium
An information disclosure vulnerability in rConfig 3.9.5 has been fixed for version 3.9.6. This vulnerability allowed remote authenticated attackers to read files on the system via a crafted request sent to to the /lib/crud/configcompare.crud.php script.
CVE-2020-25343 1 Getsymphony 1 Symphony 2024-11-21 5.4 Medium
Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.php
CVE-2020-25340 1 Nfstream 1 Nfstream 2024-11-21 5.5 Medium
An issue was discovered in NFStream 5.2.0. Because some allocated modules are not correctly freed, if the nfstream object is directly destroyed without being used after it is created, it will cause a memory leak that may result in a local denial of service (DoS).