Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (38055 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-42984 1 Wowonder 1 Wowonder 2025-04-30 9.8 Critical
WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients.
CVE-2022-40405 1 Wowonder 1 Wowonder 2025-04-30 7.5 High
WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs.
CVE-2025-3955 1 Code-projects 1 Patient Record Management System 2025-04-30 6.3 Medium
A vulnerability, which was classified as critical, was found in codeprojects Patient Record Management System 1.0. This affects an unknown part of the file /edit_rpatient.php.php. The manipulation of the argument id/lastname leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3968 1 Code-projects 1 News Publishing Site Dashboard 2025-04-30 6.3 Medium
A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /api.php. The manipulation of the argument cat_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4020 1 Phpgurukul 1 Old Age Home Management System 2025-04-30 7.3 High
A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument fname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVE-2022-45390 1 Jenkins 1 Loader.io 2025-04-30 4.3 Medium
A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-45389 1 Jenkins 1 Xp-dev 2025-04-30 5.3 Medium
A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository.
CVE-2022-45385 1 Jenkins 1 Cloudbees Docker Hub\/registry Notification 2025-04-30 7.5 High
A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
CVE-2022-42978 1 Atlassian 1 Confluence Data Center 2025-04-30 7.5 High
In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.
CVE-2025-4027 1 Phpgurukul 1 Old Age Home Management System 2025-04-30 7.3 High
A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/rules.php. The manipulation of the argument pagetitle leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-45394 1 Jenkins 1 Delete Log 2025-04-30 4.3 Medium
A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs.
CVE-2024-24375 1 Jfinalcms Project 1 Jfinalcms 2025-04-30 7.5 High
SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
CVE-2024-42773 2 Jayesh, Kashipara 2 Hotel Management System, Hotel Management System 2025-04-30 9.1 Critical
An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.
CVE-2024-29432 1 Alldata 1 Alldata 2025-04-30 9.8 Critical
Alldata v0.4.6 was discovered to contain a SQL injection vulnerability via the tablename parameter at /data/masterdata/datas.
CVE-2025-30093 1 Wisc 1 Htcondor 2025-04-30 8.1 High
HTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before 24.6.1 allows authenticated attackers to bypass authorization restrictions.
CVE-2024-55072 1 Mealie 1 Mealie 2025-04-30 5.4 Medium
A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household.
CVE-2024-37765 1 Machform 1 Machform 2025-04-30 8.8 High
Machform up to version 19 is affected by an authenticated Blind SQL injection in the user account settings page.
CVE-2024-44739 2 Oretnom23, Sourcecodester 2 Simple Forum Website, Simple Forum Website 2025-04-30 8.8 High
Sourcecodester Simple Forum Website v1.0 has a SQL injection vulnerability in /php-sqlite-forum/?page=manage_user&id=.
CVE-2024-25239 2 Sourcecodester, Walterjnr1 2 Employee Management System, Employee Management System 2025-04-30 9.8 Critical
SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POST request to /emloyee_akpoly/Account/login.php.
CVE-2024-52921 1 Bitcoin 1 Bitcoin Core 2025-04-30 5.3 Medium
In Bitcoin Core before 25.0, a peer can affect the download state of other peers by sending a mutated block.