Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357837 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-48718 1 Phpgurukul 1 Student Result Management System 2024-11-27 9.8 Critical
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'class_name' parameter of the add_students.php resource does not validate the characters received and they are sent unfiltered to the database.
CVE-2023-5961 1 Moxa 20 Iologik E1210, Iologik E1210 Firmware, Iologik E1211 and 17 more 2024-11-27 8.8 High
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.
CVE-2024-53254 2024-11-27 N/A
This CVE is a duplicate of another CVE.
CVE-2024-11160 2024-11-27 N/A
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2023-26509 1 Anydesk 1 Anydesk 2024-11-27 7.5 High
AnyDesk 7.0.8 allows remote Denial of Service.
CVE-2023-36291 1 Maxsite 1 Maxsite Cms 2024-11-27 6.1 Medium
Cross Site Scripting vulnerability in Maxsite CMS v.108.7 allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.
CVE-2023-35830 1 Stw-mobile-machines 4 Tcg-4, Tcg-4 Firmware, Tcg-4lite and 1 more 2024-11-27 9.8 Critical
STW (aka Sensor-Technik Wiedemann) TCG-4 Connectivity Module DeploymentPackage_v3.03r0-Impala and DeploymentPackage_v3.04r2-Jellyfish and TCG-4lite Connectivity Module DeploymentPackage_v3.04r2-Jellyfish allow an attacker to gain full remote access with root privileges without the need for authentication, giving an attacker arbitrary remote code execution over LTE / 4G network via SMS.
CVE-2023-33570 1 Webkul 1 Bagisto 2024-11-27 8.8 High
Bagisto v1.5.1 is vulnerable to Server-Side Template Injection (SSTI).
CVE-2023-33298 1 Perimeter81 1 Xpc Helpertool 2024-11-27 7.8 High
com.perimeter81.osx.HelperTool in Perimeter81 10.0.0.19 on macOS allows Local Privilege Escalation (to root) via shell metacharacters in usingCAPath.
CVE-2023-32223 2 D-link, Dlink 3 Dsl-224 Firmware, Dsl-224, Dsl-224 Firmware 2024-11-27 8.8 High
D-Link DSL-224 firmware version 3.0.10 allows post authentication command execution via an unspecified method.
CVE-2023-6013 1 H2o 1 H2o 2024-11-27 5.4 Medium
H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack.
CVE-2023-6021 1 Ray Project 1 Ray 2024-11-27 7.5 High
LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here: https://www.anyscale.com/blog/update-on-ray-cves-cve-2023-6019-cve-2023-6020-cve-2023-6021-cve-2023-48022-cve-2023-48023
CVE-2023-6832 1 Microweber 1 Microweber 2024-11-27 4.3 Medium
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
CVE-2023-0588 1 Catalystconnect 1 Zoho Crm Client Portal 2024-11-27 6.1 Medium
The Catalyst Connect Zoho CRM Client Portal WordPress plugin before 2.1.0 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admin.
CVE-2023-2795 1 Codecolorer Project 1 Codecolorer 2024-11-27 4.8 Medium
The CodeColorer WordPress plugin before 0.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-34240 1 Fit2cloud 1 Cloudexplorer Lite 2024-11-27 6.5 Medium
Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead to an authentication system failure and compromise system security. Versions of cloudexplorer-lite prior to 1.2.0 did not enforce strong passwords. This vulnerability has been fixed in version 1.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-21226 1 Google 1 Android 2024-11-27 7.5 High
In SAEMM_RetrieveTaiList of SAEMM_ContextManagement.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240728187References: N/A
CVE-2023-26615 2 D-link, Dlink 3 Dir-823g, Dir-823g, Dir-823g Firmware 2024-11-27 7.5 High
D-Link DIR-823G firmware version 1.02B05 has a password reset vulnerability, which originates from the SetMultipleActions API, allowing unauthorized attackers to reset the WEB page management password.
CVE-2023-30259 1 Librecad 1 Librecad 2024-11-27 5.5 Medium
A Buffer Overflow vulnerability in importshp plugin in LibreCAD 2.2.0 allows attackers to obtain sensitive information via a crafted DBF file.
CVE-2023-34928 1 H3c 3 Magic, Magic B1st, Magic B1st Firmware 2024-11-27 7.5 High
A stack overflow in the Edit_BasicSSID function of H3C Magic B1STV100R012 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.