Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361804 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-37234 1 Modern Honey Network Project 1 Modern Honey Network 2025-03-26 6.5 Medium
Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.
CVE-2021-36712 1 Yzmcms 1 Yzmcms 2025-03-26 5.4 Medium
Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.
CVE-2021-36570 1 Thedaylightstudio 1 Fuel Cms 2025-03-26 8.8 High
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---.
CVE-2021-36569 1 Thedaylightstudio 1 Fuel Cms 2025-03-26 8.8 High
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
CVE-2021-36546 1 Kitesky 1 Kitecms 2025-03-26 7.5 High
Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.
CVE-2021-36545 1 Tpcms Project 1 Tpcms 2025-03-26 5.4 Medium
Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field in Site Configuration page.
CVE-2021-36544 1 Tpcms Project 1 Tpcms 2025-03-26 7.5 High
Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.
CVE-2021-36538 1 Gurock 1 Testrail 2025-03-26 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the reference field in milestones or description fields in reports.
CVE-2021-36535 1 Cesanta 1 Mjs 2025-03-26 5.5 Medium
Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_errorf.
CVE-2021-36484 1 Jizhicms 1 Jizhicms 2025-03-26 9.8 Critical
SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
CVE-2021-36444 1 Txjia 1 Imcat 2025-03-26 8.8 High
Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token generation on the add administrator page.
CVE-2021-36443 1 Txjia 1 Imcat 2025-03-26 8.8 High
Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.
CVE-2021-36434 1 Jocms Project 1 Jocms 2025-03-26 9.1 Critical
SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_check function in jocms/apps/mask/inc/getmask.php.
CVE-2023-23948 1 Owncloud 1 Owncloud Client 2025-03-26 6.2 Medium
The ownCloud Android app allows ownCloud users to access, share, and edit files and folders. Version 2.21.1 of the ownCloud Android app is vulnerable to SQL injection in `FileContentProvider.kt`. This issue can lead to information disclosure. Two databases, `filelist` and `owncloud_database`, are affected. In version 3.0, the `filelist` database was deprecated. However, injections affecting `owncloud_database` remain relevant as of version 3.0.
CVE-2020-36250 1 Owncloud 1 Owncloud Client 2025-03-26 6.1 Medium
In the ownCloud application before 2.15 for Android, the lock protection mechanism can be bypassed by moving the system date/time into the past.
CVE-2020-36248 1 Owncloud 1 Owncloud Client 2025-03-26 3.9 Low
The ownCloud application before 2.15 for Android allows attackers to use adb to include a PIN preferences value in a backup archive, and consequently bypass the PIN lock feature by restoring from this archive.
CVE-2024-7806 1 Openwebui 1 Open Webui 2025-03-26 8.8 High
A vulnerability in open-webui/open-webui versions <= 0.3.8 allows remote code execution by non-admin users via Cross-Site Request Forgery (CSRF). The application uses cookies with the SameSite attribute set to lax for authentication and lacks CSRF tokens. This allows an attacker to craft a malicious HTML that, when accessed by a victim, can modify the Python code of an existing pipeline and execute arbitrary code with the victim's privileges.
CVE-2024-8021 1 Gradio Project 1 Gradio 2025-03-26 6.1 Medium
An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site.
CVE-2024-8026 1 Qanything 1 Qanything 2025-03-26 8.1 High
A Cross-Site Request Forgery (CSRF) vulnerability exists in the backend API of netease-youdao/qanything, as of commit d9ab8bc. The backend server has overly permissive CORS headers, allowing all cross-origin calls. This vulnerability affects all backend endpoints, enabling actions such as creating, uploading, listing, deleting files, and managing knowledge bases.
CVE-2024-40544 1 Publiccms 1 Publiccms 2025-03-26 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.