Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30336 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-29739 1 Money Transfer Management System Project 1 Money Transfer Management System 2024-11-21 9.8 Critical
Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=user/manage_user&id=.
CVE-2022-29738 1 Money Transfer Management System Project 1 Money Transfer Management System 2024-11-21 9.8 Critical
Money Transfer Management System 1.0 is vulnerable to SQL Injection via /mtms/admin/?page=transaction/send&id=, id.
CVE-2022-29730 1 Usr 10 Usr-g800v2, Usr-g800v2 Firmware, Usr-g806 and 7 more 2024-11-21 9.8 Critical
USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 was discovered to contain hard-coded credentials for its highest privileged account. The credentials cannot be altered through normal operation of the device.
CVE-2022-29712 1 Librenms 1 Librenms 2024-11-21 9.8 Critical
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
CVE-2022-29704 1 Browsbox 1 Brows Box 2024-11-21 9.8 Critical
BrowsBox CMS v4.0 was discovered to contain a SQL injection vulnerability.
CVE-2022-29660 1 Chshcms 1 Cscms Music Portal System 2024-11-21 9.8 Critical
CSCMS Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the id parameter at /admin.php/pic/admin/pic/del.
CVE-2022-29659 1 Responsive Online Blog Project 1 Responsive Online Blog 2024-11-21 9.8 Critical
Responsive Online Blog v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at single.php.
CVE-2022-29656 1 Wedding Management System Project 1 Wedding Management System 2024-11-21 9.8 Critical
Wedding Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /Wedding-Management/package_detail.php.
CVE-2022-29645 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.
CVE-2022-29644 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.
CVE-2022-29633 1 Linglong Project 1 Linglong 2024-11-21 9.8 Critical
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie.
CVE-2022-29632 1 Roncoo 1 Roncoo-education 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-29622 1 Formidable Project 1 Formidable 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted filename. NOTE: some third parties dispute this issue because the product has common use cases in which uploading arbitrary files is the desired behavior. Also, there are configuration options in all versions that can change the default behavior of how files are handled. Strapi does not consider this to be a valid vulnerability.
CVE-2022-29601 1 Oliverklee 1 Seminars 2024-11-21 9.8 Critical
The seminars (aka Seminar Manager) extension through 4.1.3 for TYPO3 allows SQL Injection.
CVE-2022-29600 1 Oliverklee 1 Oelib 2024-11-21 9.8 Critical
The oelib (aka One is Enough Library) extension through 4.1.5 for TYPO3 allows SQL Injection.
CVE-2022-29599 3 Apache, Debian, Redhat 8 Maven Shared Utils, Debian Linux, Enterprise Linux and 5 more 2024-11-21 9.8 Critical
In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVE-2022-29596 1 Microstrategy 1 Enterprise Manager 2024-11-21 9.8 Critical
MicroStrategy Enterprise Manager 2022 allows authentication bypass by triggering a login failure and then entering the Uid=/../../../../../../../../../../../windows/win.ini%00.jpg&Pwd=_any_password_&ConnMode=1&3054=Login substring for directory traversal.
CVE-2022-29592 1 Tenda 2 Tx9 Pro, Tx9 Pro Firmware 2024-11-21 9.8 Critical
Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route).
CVE-2022-29591 1 Tenda 2 Tx9 Pro, Tx9 Pro Firmware 2024-11-21 9.8 Critical
Tenda TX9 Pro 22.03.02.10 devices have a SetNetControlList buffer overflow.
CVE-2022-29556 1 Northern.tech 1 Mender 2024-11-21 9.8 Critical
The iot-manager microservice 1.0.0 in Northern.tech Mender Enterprise before 3.2.2 allows SSRF because the Azure IoT Hub integration provides several SSRF primitives that can execute cross-tenant actions via internal API endpoints.