Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (359527 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-25024 1 Vinitkumar 1 Json2xml 2024-11-21 7.5 High
The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, causing a denial of service.
CVE-2022-25023 1 Audio File Project 1 Audio File 2024-11-21 8.8 High
Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h.
CVE-2022-25022 1 Htmly 1 Htmly 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of a blog post.
CVE-2022-25020 1 Pluxml 1 Pluxml 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail path of a blog post.
CVE-2022-25018 1 Pluxml 1 Pluxml 2024-11-21 8.8 High
Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages.
CVE-2022-25017 1 Hitrontech 2 Chita, Chita Firmware 2024-11-21 9.1 Critical
Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.
CVE-2022-25016 1 Home Owners Collection Management System Project 1 Home Owners Collection Management System 2024-11-21 9.8 Critical
Home Owners Collection Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /student_attendance/index.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-25015 1 Icehrm 1 Icehrm 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name field.
CVE-2022-25014 1 Icehrm 1 Icehrm 2024-11-21 6.1 Medium
Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. This vulnerability allows attackers to compromise session credentials via user interaction with a crafted link.
CVE-2022-25013 1 Icehrm 1 Icehrm 2024-11-21 6.1 Medium
Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component login.php.
CVE-2022-25012 1 Argussurveillance 1 Dvr 2024-11-21 5.5 Medium
Argus Surveillance DVR v4.0 employs weak password encryption.
CVE-2022-25010 1 Stepmania 1 Stepmania 2024-11-21 9.1 Critical
The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system.
CVE-2022-25008 1 Totolink 4 Ex1200t, Ex1200t Firmware, Ex300 V2 and 1 more 2024-11-21 8.8 High
totolink EX300_v2 V4.0.3c.140_B20210429 and EX1200T V4.1.2cu.5230_B20210706 does not contain an authentication mechanism.
CVE-2022-25004 1 Hospital\'s Patient Records Management System Project 1 Hospital\'s Patient Records Management System 2024-11-21 9.8 Critical
Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctors/manage_doctor.php.
CVE-2022-25003 1 Hospital\'s Patient Records Management System Project 1 Hospital\'s Patient Records Management System 2024-11-21 9.8 Critical
Hospital Patient Record Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /admin/doctors/view_doctor.php.
CVE-2022-24995 1 Tenda 2 Ax3, Ax3 Firmware 2024-11-21 9.8 Critical
Tenda AX3 v16.03.12.10_CN was discovered to contain a stack overflow in the function fromSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the time parameter.
CVE-2022-24992 1 Qr Code Generator Project 1 Qr Code Generator 2024-11-21 7.5 High
A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal.
CVE-2022-24989 1 Terra-master 30 F2-210, F2-221, F2-223 and 27 more 2024-11-21 9.8 Critical
TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. (Shell metacharacters can be placed in raidtype because popen is used without any sanitization.) The credentials from CVE-2022-24990 exploitation can be used.
CVE-2022-24988 1 Galois 2p8 Project 1 Galois 2p8 2024-11-21 9.8 Critical
In galois_2p8 before 0.1.2, PrimitivePolynomialField::new has an off-by-one buffer overflow for a vector.
CVE-2022-24986 1 Kde 1 Kcron 2024-11-21 7.8 High
KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created the first time could potentially intercept the file the following time, enabling that person to run unauthorized commands.