Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (349498 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-39470 1 Papercut 1 Papercut Ng 2025-01-09 7.2 High
PaperCut NG print.script.sandboxed Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PaperCut NG. Authentication is required to exploit this vulnerability. The specific flaw exists within the management of the print.script.sandboxed setting. The issue results from the exposure of a dangerous function. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-20965.
CVE-2023-29539 2 Mozilla, Redhat 9 Firefox, Firefox Esr, Focus and 6 more 2025-01-09 8.8 High
When handling the filename directive in the Content-Disposition header, the filename would be truncated if the filename contained a NULL character. This could have led to reflected file download attacks potentially tricking users to install malware. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.
CVE-2023-29540 1 Mozilla 2 Firefox, Focus 2025-01-09 6.1 Medium
Using a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to external protocol links in sandboxed iframes without <code>allow-top-navigation-to-custom-protocols</code>. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112.
CVE-2024-29903 2 Redhat, Sigstore 2 Advanced Cluster Security, Cosign 2025-01-09 4.2 Medium
Cosign provides code signing and transparency for containers and binaries. Prior to version 2.2.4, maliciously-crafted software artifacts can cause denial of service of the machine running Cosign thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. Version 2.2.4 contains a patch for the vulnerability.
CVE-2023-27614 1 Motor Racing League Project 1 Motor Racing League 2025-01-09 5.9 Medium
Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Ian Haycox Motor Racing League plugin <= 1.9.9 versions.
CVE-2023-27358 1 Netgear 10 Rax30, Rax30 Firmware, Rax35 and 7 more 2025-01-09 8.8 High
NETGEAR RAX30 SOAP Request SQL Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of specific SOAP requests. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the service account. Was ZDI-CAN-19754.
CVE-2022-45074 1 Areteit 1 Activity Reactions For Buddypress 2025-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions.
CVE-2022-45080 1 Krishaweb 1 Add Multiple Marker 2025-01-09 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions.
CVE-2023-23879 1 Php Execution Project 1 Php Execution 2025-01-09 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Nicolas Zeh PHP Execution plugin <= 1.0.0 versions.
CVE-2023-22686 1 Trinitronic 1 Nice Paypal Button Lite 2025-01-09 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in TriniTronic Nice PayPal Button Lite plugin <= 1.3.5 versions.
CVE-2023-23892 1 M Chart Project 1 M Chart 2025-01-09 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jamie Poitra M Chart plugin <= 1.9.4 versions.
CVE-2022-47158 1 Alfred24 Click \& Collect Project 1 Alfred24 Click \& Collect 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <= 1.1.7 versions.
CVE-2022-47598 1 Wp Super Popup Project 1 Wp Super Popup 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions.
CVE-2022-41612 1 Shareaholic 1 Similar Posts 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shareaholic Similar Posts plugin <= 3.1.6 versions.
CVE-2022-45837 1 Wpjam 1 Wechat Robot 2025-01-09 7.1 High
Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions.
CVE-2023-25710 1 Digitalblue 1 Click To Call Or Chat Buttons 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions.
CVE-2023-27619 1 Machothemes 1 Regina Lite 2025-01-09 5.4 Medium
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.
CVE-2023-25490 1 Archivist - Custom Archive Templates Project 1 Archivist - Custom Archive Templates 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.
CVE-2023-25479 1 Podlove 1 Podlove Subscribe Button 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.
CVE-2023-25484 1 Simple Yearly Archive Project 1 Simple Yearly Archive 2025-01-09 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.