Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30268 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-41751 1 Jerryscript 1 Jerryscript 2024-11-21 9.8 Critical
Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021.
CVE-2021-41749 1 Nystudio107 1 Seomatic 2024-11-21 9.8 Critical
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
CVE-2021-41745 1 Showdoc 1 Showdoc 2024-11-21 9.8 Critical
ShowDoc 2.8.3 ihas a file upload vulnerability, where attackers can use the vulnerability to obtain server permissions.
CVE-2021-41744 1 Yonyou 1 Ufida Product Lifecycle Management 2024-11-21 9.8 Critical
All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life, and the collaborative creation, distribution, application and management of product information across organizations. Yonyou PLM uses jboss by default, and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions.
CVE-2021-41736 1 Grame 1 Faust 2024-11-21 9.8 Critical
Faust v2.35.0 was discovered to contain a heap-buffer overflow in the function realPropagate() at propagate.cpp.
CVE-2021-41729 1 Baicloud-cms Project 1 Baicloud-cms 2024-11-21 9.1 Critical
BaiCloud-cms v2.5.7 is affected by an arbitrary file deletion vulnerability, which allows an attacker to delete arbitrary files on the server through /user/ppsave.php.
CVE-2021-41716 1 Mahadiscom 1 Mahavitaran 2024-11-21 9.8 Critical
Maharashtra State Electricity Board Mahavitara Android Application 8.20 and prior is vulnerable to remote account takeover due to OTP fixation vulnerability in password rest function
CVE-2021-41695 1 Globaldatingsoftware 1 Premiumdatingscript 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in Premiumdatingscript 4.2.7.7 via the ip parameter in connect.php. .
CVE-2021-41694 1 Globaldatingsoftware 1 Premiumdatingscript 2024-11-21 9.8 Critical
An Incorrect Access Control vulnerability exists in Premiumdatingscript 4.2.7.7 via the password change procedure in requests\user.php.
CVE-2021-41679 1 Os4ed 1 Opensis 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter.
CVE-2021-41678 1 Os4ed 1 Opensis 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/users/Staff.php, staff{TITLE] parameter.
CVE-2021-41677 1 Os4ed 1 Opensis 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/functions/GetStuListFnc.php &Grade= parameter.
CVE-2021-41676 1 Pharmacy Point Of Sale System Project 1 Pharmacy Point Of Sale System 2024-11-21 9.8 Critical
An SQL Injection vulnerabilty exists in the oretnom23 Pharmacy Point of Sale System 1.0 in the login function in actions.php.
CVE-2021-41674 1 E-negosyo System Project 1 E-negosyo System 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in Sourcecodester E-Negosyo System 1.0 via the user_email parameter in /admin/login.php.
CVE-2021-41662 1 South Gate Inn Online Reservation System Project 1 South Gate Inn Online Reservation System 2024-11-21 9.8 Critical
The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file upload, which is caused by improper file handling in the editImg function. This vulnerability leads to remote code execution.
CVE-2021-41661 1 Church Management System Project 1 Church Management System 2024-11-21 9.8 Critical
Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell.
CVE-2021-41660 1 Patient Appointment Scheduler System Project 1 Patient Appointment Scheduler System 2024-11-21 9.8 Critical
SQL injection vulnerability in Sourcecodester Patient Appointment Scheduler System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password fields to login.php.
CVE-2021-41654 1 Wuzhicms 1 Wuzhicms 2024-11-21 9.8 Critical
SQL injection vulnerabilities exist in Wuzhicms v4.1.0 which allows attackers to execute arbitrary SQL commands via the $keyValue parameter in /coreframe/app/pay/admin/index.php
CVE-2021-41653 1 Tp-link 2 Tl-wr840n, Tl-wr840n Firmware 2024-11-21 9.8 Critical
The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.
CVE-2021-41649 1 Online-shopping-system-advanced Project 1 Online-shopping-system-advanced 2024-11-21 9.8 Critical
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.