Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357345 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-4465 1 Tipsandtricks-hq 1 Wp Video Lightbox 2025-04-07 5.4 Medium
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
CVE-2022-4449 1 Page Scroll To Id Project 1 Page Scroll To Id 2025-04-07 5.4 Medium
The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-48091 1 Hotel Management System Project 1 Hotel Management System 2025-04-07 5.4 Medium
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.
CVE-2022-46954 1 Dynamic Transaction Queuing System Project 1 Dynamic Transaction Queuing System 2025-04-07 9.8 Critical
Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_transaction.
CVE-2022-46949 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-07 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_helmet.
CVE-2022-46947 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-07 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category.
CVE-2022-46946 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-07 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_brand.
CVE-2022-46502 1 Online Student Enrollment System Project 1 Online Student Enrollment System 2025-04-07 9.8 Critical
Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.
CVE-2022-46478 1 Datax-web Project 1 Datax-web 2025-04-07 9.8 Critical
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.
CVE-2022-46471 1 Online Health Care System Project 1 Online Health Care System 2025-04-07 9.8 Critical
Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.php.
CVE-2022-42136 1 Mailenable 1 Mailenable 2025-04-07 8.8 High
Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.
CVE-2025-25783 1 Emlog 1 Emlog 2025-04-07 9.8 Critical
An arbitrary file upload vulnerability in the component admin\plugin.php of Emlog Pro v2.5.3 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVE-2025-0997 1 Google 1 Chrome 2025-04-07 8.1 High
Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
CVE-2025-1426 1 Google 1 Chrome 2025-04-07 8.8 High
Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2025-1006 1 Google 1 Chrome 2025-04-07 8.8 High
Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chromium security severity: Medium)
CVE-2025-0999 1 Google 1 Chrome 2025-04-07 8.8 High
Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2025-25791 1 Yzncms 1 Yzncms 2025-04-07 4.4 Medium
An arbitrary file upload vulnerability in the plugin installation feature of YZNCMS v2.0.1 allows attackers to execute arbitrary code via uploading a crafted Zip file.
CVE-2025-25818 1 Emlog 1 Emlog 2025-04-07 5.1 Medium
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the postStrVar function at article_save.php.
CVE-2025-0298 1 Code-projects 1 Online Book Shop 2025-04-07 6.3 Medium
A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process_login.php. The manipulation of the argument usernm leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-25823 1 Emlog 1 Emlog 2025-04-07 7.3 High
A cross-site scripting (XSS) vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the article header at /admin/article.php.