Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30251 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-40849 1 Mahara 1 Mahara 2024-11-21 9.8 Critical
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, the account associated with a web services token is vulnerable to being exploited and logged into, resulting in information disclosure (at a minimum) and often escalation of privileges.
CVE-2021-40842 1 Proofpoint 1 Insider Threat Management Server 2024-11-21 9.8 Critical
Proofpoint Insider Threat Management Server contains a SQL injection vulnerability in the Web Console. The vulnerability exists due to improper input validation on the database name parameter required in certain unauthenticated APIs. A malicious URL visited by anyone with network access to the server could be used to blindly execute arbitrary SQL statements on the backend database. Version 7.12.0 and all versions prior to 7.11.2 are affected.
CVE-2021-40818 1 Glewlwyd Sso Server Project 1 Glewlwyd Sso Server 2024-11-21 9.8 Critical
scheme/webauthn.c in Glewlwyd SSO server through 2.5.3 has a buffer overflow during FIDO2 signature validation in webauthn registration.
CVE-2021-40814 1 Mypresta 1 Customer Photo Gallery 2024-11-21 9.8 Critical
The Customer Photo Gallery addon before 2.9.4 for PrestaShop is vulnerable to SQL injection.
CVE-2021-40722 1 Adobe 2 Experience Manager, Experience Manager Cloud Service 2024-11-21 9.8 Critical
AEM Forms Cloud Service offering, as well as version 6.5.10.0 (and below) are affected by an XML External Entity (XXE) injection vulnerability that could be abused by an attacker to achieve RCE.
CVE-2021-40720 1 Adobe 1 Ops-cli 2024-11-21 9.8 Critical
Ops CLI version 2.0.4 (and earlier) is affected by a Deserialization of Untrusted Data vulnerability to achieve arbitrary code execution when the checkout_repo function is called on a maliciously crafted file. An attacker can leverage this to execute arbitrary code on the victim machine.
CVE-2021-40684 1 Talend 1 Esb Runtime 2024-11-21 9.1 Critical
Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote access to the JMX of the runtime container, which would allow an attacker the ability to read or modify the container or software running in the container.
CVE-2021-40674 1 Wuzhicms 1 Wuzhicms 2024-11-21 9.8 Critical
An SQL injection vulnerability exists in Wuzhi CMS v4.1.0 via the KeyValue parameter in coreframe/app/order/admin/index.php.
CVE-2021-40670 1 Wuzhicms 1 Wuzhicms 2024-11-21 9.8 Critical
SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords iparameter under the /coreframe/app/order/admin/card.php file.
CVE-2021-40669 1 Wuzhicms 1 Wuzhicms 2024-11-21 9.8 Critical
SQL Injection vulnerability exists in Wuzhi CMS 4.1.0 via the keywords parameter under the coreframe/app/promote/admin/index.php file.
CVE-2021-40663 1 Deep.assign Project 1 Deep.assign 2024-11-21 9.8 Critical
deep.assign npm package 0.0.0-alpha.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
CVE-2021-40643 1 Eyesofnetwork 1 Eyesofnetwork 2024-11-21 9.8 Critical
EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In the location of the "sendmail" application in the "cacti" configuration page (by default/usr/sbin/sendmail) it is possible to execute any command, which will be executed when we make a test of the configuration ("send test mail").
CVE-2021-40618 1 Os4ed 1 Opensis 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in openSIS Classic 8.0 via the 1) ADDR_CONT_USRN, 2) ADDR_CONT_PSWD, 3) SECN_CONT_USRN or 4) SECN_CONT_PSWD parameters in HoldAddressFields.php.
CVE-2021-40612 1 Opmantek 1 Open-audit 2024-11-21 9.8 Critical
An issue was discovered in Opmantek Open-AudIT after 3.5.0. Without authentication, a vulnerability in code_igniter/application/controllers/util.php allows an attacker perform command execution without echoes.
CVE-2021-40604 1 Invisioncommunity 1 Ips Community Suite 2024-11-21 9.1 Critical
A Server-Side Request Forgery (SSRF) vulnerability in IPS Community Suite before 4.6.2 allows remote authenticated users to request arbitrary URLs or trigger deserialization via phar protocol when generating class names dynamically. In some cases an exploitation is possible by an unauthenticated user.
CVE-2021-40597 1 Edimax 2 Ic-3140w, Ic-3140w Firmware 2024-11-21 9.8 Critical
The firmware of EDIMAX IC-3140W Version 3.11 is hardcoded with Administrator username and password.
CVE-2021-40595 1 Online Leave Management System Project 1 Online Leave Management System 2024-11-21 9.8 Critical
SQL injection vulnerability in Sourcecodester Online Leave Management System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username parameter to /leave_system/classes/Login.php.
CVE-2021-40589 1 Zangband-data Project 1 Zangband-data 2024-11-21 9.8 Critical
ZAngband zangband-data 2.7.5 is affected by an integer underflow vulnerability in src/tk/plat.c through the variable fileheader.bfOffBits.
CVE-2021-40543 1 Os4ed 1 Opensis 2024-11-21 9.8 Critical
Opensis-Classic Version 8.0 is affected by a SQL injection vulnerability due to a lack of sanitization of input data at two parameters $_GET['usrid'] and $_GET['prof_id'] in the PasswordCheck.php file.
CVE-2021-40540 1 Ulfius Project 1 Ulfius 2024-11-21 9.8 Critical
ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.