Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (349502 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-47048 1 Rocket.chat 1 Rocket.chat 2025-03-25 5.4 Medium
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier allows stored XSS in the description and release notes of the marketplace and private apps.
CVE-2024-46935 1 Rocket.chat 1 Rocket.chat 2025-03-25 7.5 High
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS). Attackers who craft messages with specific characters may crash the workspace due to an issue in the message parser.
CVE-2024-46934 1 Rocket.chat 1 Rocket.chat 2025-03-25 6.1 Medium
Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to DOM-based Cross-site Scripting (XSS). Attackers may be able to abuse the UpdateOTRAck method to forge a message that contains an XSS payload.
CVE-2024-46372 1 Dedecms 1 Dedecms 2025-03-25 6.1 Medium
DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement management module.
CVE-2024-45987 1 Online Voting System Project 1 Online Voting System 2025-03-25 6.5 Medium
Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated user, automatically submits a vote for a specified party without the user's consent or knowledge. The attack leverages the user's active session to perform the unauthorized action, compromising the integrity of the voting process.
CVE-2024-45836 1 Planex 10 Cs-qr10, Cs-qr10 Firmware, Cs-qr20 and 7 more 2025-03-25 6.1 Medium
Cross-site scripting vulnerability exists in the web management page of PLANEX COMMUNICATIONS network cameras. If a logged-in user accesses a specific file, an arbitrary script may be executed on the web browser of the user.
CVE-2024-44776 1 Vtiger 1 Vtiger Crm 2025-03-25 6.1 Medium
An Open Redirect vulnerability in the page parameter of vTiger CRM v7.4.0 allows attackers to redirect users to a malicious site via a crafted URL.
CVE-2024-43045 1 Jenkins 1 Jenkins 2025-03-25 6.3 Medium
Jenkins 2.470 and earlier, LTS 2.452.3 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views".
CVE-2024-43025 1 Rws 1 Multitrans 2025-03-25 6.1 Medium
An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout and possibly execute a phishing attack via a crafted payload injected into a sent e-mail.
CVE-2024-43024 1 Rws 1 Multitrans 2025-03-25 6.1 Medium
Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2024-42978 1 Tenda 2 Fh1206, Fh1206 Firmware 2025-03-25 9.8 Critical
An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request.
CVE-2024-42680 1 Cysoft168 1 Super Easy Enterprise Management System 2025-03-25 5.5 Medium
An issue in Super easy enterprise management system v.1.0.0 and before allows a local attacker to obtain the server absolute path by entering a single quotation mark.
CVE-2024-41482 1 Typora 1 Typora 2025-03-25 6.1 Medium
Typora before 1.9.3 Markdown editor has a cross-site scripting (XSS) vulnerability via the MathJax component.
CVE-2024-41445 1 Ihedvall 1 Mdf Library 2025-03-25 6.5 Medium
Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function
CVE-2024-40598 1 Mediawiki 1 Mediawiki 2025-03-25 4.3 Medium
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted attribute is not applied to entries.)
CVE-2024-40549 1 Publiccms 1 Publiccms 2025-03-25 8.8 High
An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2024-40519 1 Seacms 1 Seacms 2025-03-25 8.8 High
SeaCMS 12.9 has a remote code execution vulnerability. The vulnerability is caused by admin_smtp.php directly splicing and writing the user input data into weixin.php without processing it, which allows authenticated attackers to exploit the vulnerability to execute arbitrary commands and obtain system permissions.
CVE-2024-40395 1 Ptc 1 Thingworx 2025-03-25 6.5 Medium
An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level.
CVE-2024-39838 1 Zexelon 2 Zwx-2000csw2-hn, Zwx-2000csw2-hn Firmware 2025-03-25 8.8 High
ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15 uses hard-coded credentials, which may allow a network-adjacent attacker with an administrative privilege to alter the configuration of the device.
CVE-2024-39734 1 Ibm 1 Datacap 2025-03-25 4.3 Medium
IBM Datacap Navigator 9.1.5, 9.1.6, 9.1.7, 9.1.8, and 9.1.9 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 296001.