Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (336386 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-20642 1 Eyoucms 1 Eyoucms 2024-11-21 8.8 High
Cross Site Request Forgery (CSRF) vulnerability exists in EyouCMS 1.3.6 that can add an htm page to execute the js code via login.php?m=admin&c=Filemanager&a=newfile&lang=cn.
CVE-2020-20640 1 Shopex 1 Ecshop 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues, in the user.php file, we can use the html entity encoding to bypass the security policy of the safety.php file, triggering the xss vulnerability.
CVE-2020-20634 1 Elementor 1 Website Builder 2024-11-21 6.5 Medium
Elementor 2.9.5 and below WordPress plugin allows authenticated users to activate its safe mode feature. This can be exploited to disable all security plugins on the blog.
CVE-2020-20633 1 Cookielawinfo 1 Gdpr Cookie Consent 2024-11-21 5.4 Medium
ajax_policy_generator in admin/modules/cli-policy-generator/classes/class-policy-generator-ajax.php in GDPR Cookie Consent (cookie-law-info) 1.8.2 and below plugin for WordPress, allows authenticated stored XSS and privilege escalation.
CVE-2020-20628 1 Appsaloon 1 Wp-gdpr 2024-11-21 6.1 Medium
controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.
CVE-2020-20627 1 Givewp 1 Givewp 2024-11-21 5.3 Medium
The includes/gateways/stripe/includes/admin/admin-actions.php in GiveWP plugin through 2.5.9 for WordPress allows unauthenticated settings change.
CVE-2020-20626 1 Lara\'s Google Analytics Project 1 Lara\'s Google Analytics 2024-11-21 5.4 Medium
lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.
CVE-2020-20625 1 Slicedinvoices 1 Sliced Invoices 2024-11-21 7.5 High
Sliced Invoices plugin for WordPress 3.8.2 and earlier allows unauthenticated information disclosure and authenticated SQL injection via core/class-sliced.php.
CVE-2020-20605 1 Personal Blog Cms Project 1 Personal Blog Cms 2024-11-21 6.1 Medium
Blog CMS v1.0 contains a cross-site scripting (XSS) vulnerability in the /controller/CommentAdminController.java component.
CVE-2020-20601 1 Thinkcmf 1 Thinkcmf 2024-11-21 9.8 Critical
An issue in ThinkCMF X2.2.2 and below allows attackers to execute arbitrary code via a crafted packet.
CVE-2020-20600 1 Metinfo 1 Metinfo 2024-11-21 5.4 Medium
MetInfo 7.0 beta contains a stored cross-site scripting (XSS) vulnerability in the $name parameter of admin/?n=column&c=index&a=doAddColumn.
CVE-2020-20598 1 Mossle 1 Lemon 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the Editing component of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-20597 1 Mossle 1 Lemon 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the potrtalItemName parameter in \web\PortalController.java of lemon V1.10.0 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-20595 1 Opms Project 1 Opms 2024-11-21 6.5 Medium
A cross-site request forgery (CSRF) in OPMS v1.3 and below allows attackers to arbitrarily add a user account via /user/add.
CVE-2020-20593 1 Rockoa 1 Rockoa 2024-11-21 8.0 High
A cross-site request forgery (CSRF) in Rockoa v1.9.8 allows an authenticated attacker to arbitrarily add an administrator account.
CVE-2020-20586 1 Xyhcms 1 Xyhcms 2024-11-21 4.5 Medium
A cross site request forgery (CSRF) vulnerability in the /xyhai.php?s=/Auth/editUser URI of XYHCMS V3.6 allows attackers to edit any information of the administrator such as the name, e-mail, and password.
CVE-2020-20585 1 Metinfo 1 Metinfo 2024-11-21 7.5 High
A blind SQL injection in /admin/?n=logs&c=index&a=dode of Metinfo 7.0 beta allows attackers to access sensitive database information.
CVE-2020-20584 1 Baigo 1 Baigo Cms 2024-11-21 6.1 Medium
A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/.
CVE-2020-20583 1 8cms 1 Ljcms 2024-11-21 7.5 High
A SQL injection vulnerability in /question.php of LJCMS Version v4.3.R60321 allows attackers to obtain sensitive database information.
CVE-2020-20582 1 Mipcms 1 Mipcms 2024-11-21 7.5 High
A server side request forgery (SSRF) vulnerability in /ApiAdminDomainSettings.php of MipCMS 5.0.1 allows attackers to access sensitive information.