Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (38058 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-25993 1 Feminer Wms Project 1 Feminer Wms 2025-05-02 5.1 Medium
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid."
CVE-2025-25994 1 Feminer Wms Project 1 Feminer Wms 2025-05-02 7.5 High
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.
CVE-2024-57683 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 4.3 Medium
An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request.
CVE-2024-57682 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An information disclosure vulnerability in the component d_status.asp of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request.
CVE-2024-57681 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 5.3 Medium
An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request.
CVE-2024-57680 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 5.3 Medium
An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request.
CVE-2024-57679 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request.
CVE-2024-57678 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request.
CVE-2024-57677 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request.
CVE-2024-57676 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request.
CVE-2023-34051 1 Vmware 1 Aria Operations For Logs 2025-05-02 9.8 Critical
VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
CVE-2022-41259 1 Sap 1 Sql Anywhere 2025-05-02 6.5 Medium
SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the server with some queries that use an ARRAY constructor.
CVE-2022-43227 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-02 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/view_appointment.
CVE-2024-36732 1 Oneflow 1 Oneflow 2025-05-02 7.5 High
An issue in OneFlow-Inc. Oneflow v0.9.1 allows attackers to cause a Denial of Service (DoS) when an empty array is processed with oneflow.tensordot.
CVE-2023-33265 1 Hazelcast 2 Hazelcast, Imdg 2025-05-02 8.8 High
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
CVE-2022-3451 1 Addify 1 Product Stock Manager 2025-05-01 4.3 Medium
The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
CVE-2023-5346 2 Fedoraproject, Google 2 Fedora, Chrome 2025-05-01 8.8 High
Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-21244 1 Google 1 Android 2025-05-01 6.7 Medium
In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.
CVE-2022-3819 1 Gitlab 1 Gitlab 2025-05-01 3.5 Low
An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to.
CVE-2022-3494 1 Really-simple-plugins 1 Complianz 2025-05-01 8.8 High
The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.