Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30281 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-46451 1 Online Project Time Management System Project 1 Online Project Time Management System 2024-11-21 9.8 Critical
An SQL Injection vulnerabilty exists in Sourcecodester Online Project Time Management System 1.0 via the pid parameter in the load_file function.
CVE-2021-46448 1 Hhg-multistore 1 Multistore 2024-11-21 9.8 Critical
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/customers.php?page=1&cID.
CVE-2021-46446 1 Hhg-multistore 1 Multistore 2024-11-21 9.8 Critical
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_access_group_edit&aagID.
CVE-2021-46445 1 Hhg-multistore 1 Multistore 2024-11-21 9.8 Critical
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/categories.php?box_group_id.
CVE-2021-46444 1 Hhg-multistore 1 Multistore 2024-11-21 9.8 Critical
H.H.G Multistore v5.1.0 and below was discovered to contain a SQL injection vulnerability via /admin/admin.php?module=admin_group_edit&agID.
CVE-2021-46442 1 Dlink 2 Dir-825, Dir-825 Firmware 2024-11-21 9.8 Critical
In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.
CVE-2021-46433 1 Fenom Project 1 Fenom 2024-11-21 10.0 Critical
In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
CVE-2021-46428 1 Simple Chatbot Application Project 1 Simple Chatbot Application 2024-11-21 9.8 Critical
A Remote Code Execution (RCE) vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 ( and previous versions via the bot_avatar parameter in SystemSettings.php.
CVE-2021-46427 1 Simple Chatbot Application Project 1 Simple Chatbot Application 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in Sourcecodester Simple Chatbot Application 1.0 via the message parameter in Master.php.
CVE-2021-46424 1 Telesquare 2 Tlr-2005ksh, Tlr-2005ksh Firmware 2024-11-21 9.1 Critical
Telesquare TLR-2005KSH 1.0.0 is affected by an arbitrary file deletion vulnerability that allows a remote attacker to delete any file, even system internal files, via a DELETE request.
CVE-2021-46422 1 Telesquare 2 Sdt-cs3b1, Sdt-cs3b1 Firmware 2024-11-21 9.8 Critical
Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.
CVE-2021-46419 1 Telesquare 2 Tlr-2855ks6, Tlr-2855ks6 Firmware 2024-11-21 9.1 Critical
An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.
CVE-2021-46394 1 Tenda 2 Ax3, Ax3 Firmware 2024-11-21 9.8 Critical
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check, which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
CVE-2021-46393 1 Tenda 2 Ax3, Ax3 Firmware 2024-11-21 9.8 Critical
There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check,which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp, the attacker can easily perform remote code execution with carefully crafted overflow data.
CVE-2021-46386 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
CVE-2021-46384 1 Mingsoft 1 Mcms 2024-11-21 9.8 Critical
https://gitee.com/mingSoft/MCMS MCMS <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ΒΆΒΆ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.
CVE-2021-46377 1 Cskaza 1 Cszcms 2024-11-21 9.8 Critical
There is a front-end sql injection vulnerability in cszcms 1.2.9 via cszcms/controllers/Member.php#viewUser
CVE-2021-46362 1 Magnolia-cms 1 Magnolia Cms 2024-11-21 9.8 Critical
A Server-Side Template Injection (SSTI) vulnerability in the Registration and Forgotten Password forms of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted payload entered into the fullname parameter.
CVE-2021-46361 1 Magnolia-cms 1 Magnolia Cms 2024-11-21 9.8 Critical
An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a crafted FreeMarker payload.
CVE-2021-46321 1 Tenda 2 Ac11, Ac11 Firmware 2024-11-21 9.8 Critical
Tenda AC Series Router AC11_V02.03.01.104_CN was discovered to contain a stack buffer overflow in the wifiBasicCfg module. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.