Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30123 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-26528 1 Cesanta 1 Mongoose 2024-11-21 9.1 Critical
The mg_http_serve_file function in Cesanta Mongoose HTTP server 7.0 is vulnerable to remote OOB write attack via connection request after exhausting memory pool.
CVE-2021-26505 1 Hello.js Project 1 Hello.js 2024-11-21 9.8 Critical
Prototype pollution vulnerability in MrSwitch hello.js version 1.18.6, allows remote attackers to execute arbitrary code via hello.utils.extend function.
CVE-2021-26476 1 Eprints 1 Eprints 2024-11-21 9.8 Critical
EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI.
CVE-2021-26473 1 Vembu 2 Bdr Suite, Offsite Dr 2024-11-21 9.8 Critical
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 the http API located at /sgwebservice_o.php action logFilePath allows an attacker to write arbitrary files in the context of the web server process. These files can then be executed remotely by calling the file via the web server.
CVE-2021-26472 2 Microsoft, Vembu 3 Windows, Bdr Suite, Offsite Dr 2024-11-21 10 Critical
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1 installed on Windows, the http API located at /consumerweb/secure/download.php. Using this command argument an unauthenticated attacker can execute arbitrary OS commands with SYSTEM privileges.
CVE-2021-26471 1 Vembu 2 Bdr Suite, Offsite Dr 2024-11-21 9.8 Critical
In VembuBDR before 4.2.0.1 and VembuOffsiteDR before 4.2.0.1, the http API located at /sgwebservice_o.php accepts a command argument. Using this command argument an unauthenticated attacker can execute arbitrary shell commands.
CVE-2021-26461 1 Apache 1 Nuttx 2024-11-21 9.8 Critical
Apache Nuttx Versions prior to 10.1.0 are vulnerable to integer wrap-around in functions malloc, realloc and memalign. This improper memory assignment can lead to arbitrary memory allocation, resulting in unexpected behavior such as a crash or a remote code injection/execution.
CVE-2021-26427 1 Microsoft 1 Exchange Server 2024-11-21 9 Critical
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26334 3 Amd, Linux, Microsoft 3 Amd Uprof, Linux Kernel, Windows 2024-11-21 9.9 Critical
The AMDPowerProfiler.sys driver of AMD μProf tool may allow lower privileged users to access MSRs in kernel which may lead to privilege escalation and ring-0 code execution by the lower privileged user.
CVE-2021-26305 1 Cdr Project 1 Cdr 2024-11-21 9.8 Critical
An issue was discovered in Deserializer::read_vec in the cdr crate before 0.2.4 for Rust. A user-provided Read implementation can gain access to the old contents of newly allocated heap memory, violating soundness.
CVE-2021-26293 1 Afterlogic 2 Aurora, Webmail Pro 2024-11-21 9.8 Critical
An issue was discovered in AfterLogic Aurora through 8.5.3 and WebMail Pro through 8.5.3, when DAV is enabled. They allow directory traversal to create new files (such as an executable file under the web root). This is related to DAVServer.php in 8.x and DAV/Server.php in 7.x.
CVE-2021-26291 4 Apache, Oracle, Quarkus and 1 more 9 Maven, Financial Services Analytical Applications Infrastructure, Goldengate Big Data And Application Adapters and 6 more 2024-11-21 9.1 Critical
Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
CVE-2021-26275 1 Eslint-fixer Project 1 Eslint-fixer 2024-11-21 9.8 Critical
The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted
CVE-2021-26232 1 Simple College Website Project 1 Simple College Website 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php.
CVE-2021-26231 1 Fantastic Blog Cms Project 1 Fantastic Blog Cms 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Fantastic Blog CMS v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to category.php.
CVE-2021-26229 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_stud.php.
CVE-2021-26228 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_class1.php.
CVE-2021-26226 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to edit_user.php.
CVE-2021-26223 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_pay.php.
CVE-2021-26201 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 9.8 Critical
The Login Panel of CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection authentication bypass. An attacker can obtain access to the admin panel by injecting a SQL query in the username field of the login page.