Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (371926 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-26266 1 Liferay 2 Digital Experience Platform, Liferay Portal 2025-01-28 9 Critical
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Liferay DXP 7.4 before update 10, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name text field of the user who creates an entry in the (1) Announcement widget, or (2) Alerts widget.
CVE-2024-25151 1 Liferay 2 Digital Experience Platform, Liferay Portal 2025-01-28 5.4 Medium
The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not escape user supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event or the user's name. This may lead to a content spoofing or cross-site scripting (XSS) attacks depending on the capability of the receiver's mail client.
CVE-2023-27563 1 N8n 1 N8n 2025-01-27 8.8 High
The n8n package 0.218.0 for Node.js allows Escalation of Privileges.
CVE-2023-27562 1 N8n 1 N8n 2025-01-27 6.5 Medium
The n8n package 0.218.0 for Node.js allows Directory Traversal.
CVE-2023-32573 2 Qt, Redhat 2 Qt, Enterprise Linux 2025-01-27 6.5 Medium
In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.
CVE-2023-31903 1 Freeguppy 1 Guppy 2025-01-27 9.8 Critical
GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.
CVE-2023-31587 1 Tenda 2 Ac5, Ac5 Firmware 2025-01-27 9.8 Critical
Tenda AC5 router V15.03.06.28 was discovered to contain a remote code execution (RCE) vulnerability via the Mac parameter at ip/goform/WriteFacMac.
CVE-2023-27919 1 Next-engine 1 Next Engine Integration 2025-01-27 5.3 Medium
Authentication bypass vulnerability in NEXT ENGINE Integration Plugin (for EC-CUBE 2.0 series) all versions allows a remote unauthenticated attacker to alter the information stored in the system.
CVE-2023-27918 1 Tms-outsource 1 Amelia 2025-01-27 6.1 Medium
Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1.0.76 allows a remote unauthenticated attacker to inject an arbitrary script by having a user who is logging in the WordPress where the product is installed visit a malicious URL.
CVE-2023-27889 1 Lqd 1 Liquid Speech Balloon 2025-01-27 8.8 High
Cross-site request forgery (CSRF) vulnerability in LIQUID SPEECH BALLOON versions prior to 1.2 allows a remote unauthenticated attacker to hijack the authentication of a user and to perform unintended operations by having a user view a malicious page.
CVE-2023-27888 1 Sitebridge 1 Joruri Gw 2025-01-27 5.4 Medium
Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject an arbitrary script via Message Memo function of the affected product.
CVE-2023-27564 1 N8n 1 N8n 2025-01-27 7.5 High
The n8n package 0.218.0 for Node.js allows Information Disclosure.
CVE-2023-31471 1 Gl-inet 64 Gl-a1300, Gl-a1300 Firmware, Gl-ap1300 and 61 more 2025-01-27 9.8 Critical
An issue was discovered on GL.iNet devices before 3.216. Through the software installation feature, it is possible to install arbitrary software, such as a reverse shell, because the restrictions on the available package list are limited to client-side verification. It is possible to install software from the filesystem, the package list, or a URL.
CVE-2023-30356 1 Tenda 2 Cp3, Cp3 Firmware 2025-01-27 7.5 High
Missing Support for an Integrity Check in Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows attackers to update the device with crafted firmware
CVE-2023-30354 1 Tenda 2 Cp3, Cp3 Firmware 2025-01-27 9.8 Critical
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access.
CVE-2023-30353 1 Tenda 2 Cp3, Cp3 Firmware 2025-01-27 9.8 Critical
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.
CVE-2023-30352 1 Tenda 2 Cp3, Cp3 Firmware 2025-01-27 9.8 Critical
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for the RTSP feed.
CVE-2023-30351 1 Tenda 2 Cp3, Cp3 Firmware 2025-01-27 7.5 High
Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 was discovered to contain a hard-coded default password for root which is stored using weak encryption. This vulnerability allows attackers to connect to the TELNET service (or UART) by using the exposed credentials.
CVE-2023-30194 1 Prestashop 1 Poststaticfooter 2025-01-27 9.8 Critical
Prestashop posstaticfooter <= 1.0.0 is vulnerable to SQL Injection via posstaticfooter::getPosCurrentHook().
CVE-2023-29930 1 Genesys 1 Tftp Server 2025-01-27 8.8 High
An issue was found in Genesys CIC Polycom phone provisioning TFTP Server all version allows a remote attacker to execute arbitrary code via the login crednetials to the TFTP server configuration page.