Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (360672 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-27705 1 Leantime 1 Leantime 2025-04-08 7.6 High
Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files/browse endpoint.
CVE-2024-27474 1 Leantime 1 Leantime 2025-04-08 8.8 High
Leantime 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF). This vulnerability allows malicious actors to perform unauthorized actions on behalf of authenticated users, specifically administrators.
CVE-2024-27476 1 Leantime 1 Leantime 2025-04-08 4.7 Medium
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket.
CVE-2024-27477 1 Leantime 1 Leantime 2025-04-08 6.1 Medium
In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks.
CVE-2024-22722 1 Formtools 1 Form Tools 2025-04-08 7.2 High
Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application.
CVE-2024-22721 1 Formtools 1 Form Tools 2025-04-08 6.3 Medium
Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link.
CVE-2024-22719 1 Formtools 1 Form Tools 2025-04-08 8.1 High
SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client.
CVE-2024-22718 1 Formtools 1 Form Tools 2025-04-08 9.6 Critical
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL.
CVE-2024-22717 1 Formtools 1 Form Tools 2025-04-08 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application.
CVE-2024-31678 2 Loan Management System Project, Razormist 2 Loan Management System, Loan Management System 2025-04-08 9.8 Critical
Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file.
CVE-2024-29220 1 Ninjaforms 1 Ninja Forms 2025-04-08 6.1 Medium
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
CVE-2024-26019 1 Ninjaforms 1 Ninja Forms 2025-04-08 5.4 Medium
Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product.
CVE-2024-25572 2 Ninjaforms, Saturday Drive 2 Ninja Forms, Ninja Forms 2025-04-08 8.8 High
Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed.
CVE-2022-46623 1 Judging Management System Project 1 Judging Management System 2025-04-08 7.8 High
Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVE-2022-46622 1 Judging Management System Project 1 Judging Management System 2025-04-08 6.1 Medium
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
CVE-2022-46503 1 Online Student Enrollment System Project 1 Online Student Enrollment System 2025-04-08 5.4 Medium
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter.
CVE-2022-46472 1 Helmet Store Showroom Site Project 1 Helmet Store Showroom Site 2025-04-08 7.2 High
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete.
CVE-2022-46370 1 Maxum 1 Rumpus 2025-04-08 7.3 High
Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification.
CVE-2022-3628 2 Linux, Redhat 4 Linux Kernel, Enterprise Linux, Rhel Eus and 1 more 2025-04-08 6.6 Medium
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.
CVE-2022-25027 1 Rocketsoftware 1 Trufusion Enterprise 2025-04-08 7.5 High
The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked.