Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30268 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-42064 1 Sap 1 Commerce 2024-11-21 9.8 Critical
If configured to use an Oracle database and if a query is created using the flexible search java api with a parameterized "in" clause, SAP Commerce - versions 1905, 2005, 2105, 2011, allows attacker to execute crafted database queries, exposing backend database. The vulnerability is present if the parameterized "in" clause accepts more than 1000 values.
CVE-2021-42002 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADManager Plus before 7115 is vulnerable to a filter bypass that leads to file-upload remote code execution.
CVE-2021-41974 1 Tad Book3 Project 1 Tad Book3 2024-11-21 9.1 Critical
Tad Book3 editing book page does not perform identity verification. Remote attackers can use the vulnerability to view and modify arbitrary content of books without permission.
CVE-2021-41950 1 Montala 1 Resourcespace 2024-11-21 9.1 Critical
A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. Attackers can delete configuration or source code files, causing the application to become unavailable to all users.
CVE-2021-41945 1 Encode 1 Httpx 2024-11-21 9.1 Critical
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
CVE-2021-41931 1 Recruitment Management System Project 1 Recruitment Management System 2024-11-21 9.8 Critical
The Company's Recruitment Management System in id=2 of the parameter from view_vacancy app on-page appears to be vulnerable to SQL injection. The payloads 19424269' or '1309'='1309 and 39476597' or '2917'='2923 were each submitted in the id parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
CVE-2021-41928 1 Try My Recipe Project 1 Try My Recipe 2024-11-21 9.8 Critical
SQL injection in Sourcecodester Try My Recipe (Recipe Sharing Website - CMS) 1.0 by oretnom23, allows attackers to execute arbitrary code via the rid parameter to the view_recipe page.
CVE-2021-41921 1 Xxyopen 1 Novel-plus 2024-11-21 9.8 Critical
novel-plus V3.6.1 allows unrestricted file uploads. Unrestricted file suffixes and contents can lead to server attacks and arbitrary code execution.
CVE-2021-41873 1 Skyworth 2 Penguin Aurora Box, Penguin Aurora Box Firmware 2024-11-21 10.0 Critical
Penguin Aurora TV Box 41502 is a high-end network HD set-top box produced by Tencent Video and Skyworth Digital. An unauthorized access vulnerability exists in the Penguin Aurora Box. An attacker can use the vulnerability to gain unauthorized access to a specific link to remotely control the TV.
CVE-2021-41868 1 Onionshare 1 Onionshare 2024-11-21 9.8 Critical
OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.
CVE-2021-41862 1 Aviatorscript Project 1 Aviatorscript 2024-11-21 9.8 Critical
AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).
CVE-2021-41844 1 Crocoblock 1 Jetengine 2024-11-21 9.8 Critical
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data.
CVE-2021-41842 1 Insyde 1 Insydeh2o 2024-11-21 9.8 Critical
An issue was discovered in AtaLegacySmm in the kernel 5.0 before 05.08.46, 5.1 before 05.16.46, 5.2 before 05.26.46, 5.3 before 05.35.46, 5.4 before 05.43.46, and 5.5 before 05.51.45 in Insyde InsydeH2O. Code execution can occur because the SMI handler lacks a CommBuffer check.
CVE-2021-41833 1 Zohocorp 1 Manageengine Patch Connect Plus 2024-11-21 9.8 Critical
Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.
CVE-2021-41816 3 Fedoraproject, Redhat, Ruby-lang 4 Fedora, Rhel Software Collections, Cgi and 1 more 2024-11-21 9.8 Critical
CGI.escape_html in Ruby before 2.7.5 and 3.x before 3.0.3 has an integer overflow and resultant buffer overflow via a long string on platforms (such as Windows) where size_t and long have different numbers of bytes. This also affects the CGI gem before 0.3.1 for Ruby.
CVE-2021-41765 1 Montala 1 Resourcespace 2024-11-21 9.8 Critical
A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. This allows attackers to uncover the full contents of the ResourceSpace database, including user session cookies. An attacker who gets an admin user session cookie can use the session cookie to execute arbitrary code on the server.
CVE-2021-41756 1 Dynamicvision 1 Dynamicmarkt 2024-11-21 9.8 Critical
dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.
CVE-2021-41755 1 Dynamicvision 1 Dynamicmarkt 2024-11-21 9.8 Critical
dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.
CVE-2021-41754 1 Dynamicvision 1 Dynamicmarkt 2024-11-21 9.8 Critical
dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.
CVE-2021-41752 1 Jerryscript 1 Jerryscript 2024-11-21 9.8 Critical
Stack overflow vulnerability in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021 due to an unbounded recursive call to the new opt() function.