Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,826

CVE-2021-4229

ua-parser-js Crypto Mining backdoor

A vulnerability was found in ua-parser-js 0.7.29/0.8.0/1.0.0. It has been rated as critical. This issue affects the crypto mining component which introduces a backdoor. Upgrading to version 0.7.30, 0.8.1 and 1.0.1 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5 Medium EPSS 1.5% KEV · Not listed
Vendors
Ua-parser-js Project
Products
Ua-parser-js
CVE-2021-4230

Airfield Online MySQL Backup improper authentication

A vulnerability has been found in Airfield Online and classified as problematic. This vulnerability affects the path /backups/ of the MySQL backup handler. An attacker is able to get access to sensitive data without proper authentication. It is recommended to the change the configuration settings.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Airfield Online Project
Products
Airfield Online
CVE-2021-4232

Zoo Management System manage-ticket.php cross site scripting

A vulnerability classified as problematic has been found in Zoo Management System 1.0. Affected is an unknown function of the file admin/manage-ticket.php. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. It is possible to launch the attack remotely.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Phpgurukul
Products
Zoo Management System
CVE-2022-1979

SourceCodester Product Show Room Site p=contact cross site scripting

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Product Show Room Site Project
Products
Product Show Room Site
CVE-2022-1980

SourceCodester Product Show Room Site cross site scripting

A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 2.4 Low EPSS < 1% KEV · Not listed
Vendors
Product Show Room Site Project
Products
Product Show Room Site
CVE-2022-1991

Fast Food Ordering System Master List Master.php cross site scripting

A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross site scripting. It is possible to launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Fast Food Ordering System Project
Products
Fast Food Ordering System
CVE-2022-23556

CodeIgniter is vulnerable to IP address spoofing when using proxy

CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This issue has been patched, please upgrade to version 4.2.11 or later, and configure `Config\App::$proxyIPs`. As a workaround, do not use `$request->getIPAddress()`.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Codeigniter
Products
Codeigniter
CVE-2020-36527

Server Status HTTP Status/SMTP Status cross site scripting

A vulnerability, which was classified as problematic, has been found in Server Status. This issue affects some unknown processing of the component HTTP Status/SMTP Status. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Aptis-solutions
Products
Server Status
CVE-2020-36528

Platinum Mobile MobileHandler.ashx access control

A vulnerability, which was classified as critical, was found in Platinum Mobile 1.0.4.850. Affected is /MobileHandler.ashx which leads to broken access control. The attack requires authentication. Upgrading to version 1.0.4.851 is able to address this issue. It is recommended to upgrade the affected component.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Platinumchina
Products
Platinum Mobile
CVE-2020-36529

SevOne Network Management System Traceroute traceroute.php command injection

A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the Traceroute Handler. The manipulation leads to privilege escalation with a command injection. It is possible to initiate the attack remotely.

CVSS 3.1 · 8.8 High EPSS 3.8% KEV · Not listed
Vendors
Ibm
Products
Sevone Network Performance Management
CVE-2020-36530

SevOne Network Management System Alert Summary sql injection

A vulnerability classified as critical was found in SevOne Network Management System up to 5.7.2.22. This vulnerability affects the Alert Summary. The manipulation leads to sql injection. The attack can be initiated remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sevone Network Performance Management
CVE-2020-36531

SevOne Network Management System Device Manager Page injection

A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Sevone Network Performance Management
CVE-2020-36533

Klapp App JSON Web Token improper authentication

A vulnerability was found in Klapp App and classified as problematic. This issue affects some unknown processing of the JSON Web Token Handler. The manipulation leads to weak authentication. The attack may be initiated remotely.

CVSS 3.1 · 3.7 Low EPSS 1.5% KEV · Not listed
Vendors
Klapp
Products
App
CVE-2020-36534

easyii CMS out cross-site request forgery

A vulnerability was found in easyii CMS. It has been classified as problematic. Affected is an unknown function of the file /admin/sign/out. The manipulation leads to cross site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Easyiicms
Products
Easyiicms
CVE-2020-36535

MINMAX newsDia.php sql injection

A vulnerability classified as critical has been found in MINMAX. This affects an unknown part of the file /newsDia.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Minmax
Products
Minmax
CVE-2020-36536

Brandbugle main.php sql injection

A vulnerability was found in Brandbugle. It has been rated as critical. Affected by this issue is some unknown functionality of the file /main.php. The manipulation leads to sql injection. The attack may be launched remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Brandbugle
Products
Brandbugle
CVE-2020-36538

Eatan CMS sql injection

A vulnerability was found in Eatan CMS. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to sql injection. The attack can be launched remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Etan
Products
Etan Cms
CVE-2020-36539

Lógico y Creativo sql injection

A vulnerability was found in Lógico y Creativo 1.0 and classified as critical. This issue affects some unknown processing. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Logicoycreativo
Products
Logico Y Creativo
CVE-2020-36540

Neetai Tech product.php sql injection

A vulnerability, which was classified as critical, was found in Neetai Tech. Affected is an unknown function of the file /product.php. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Neetai
Products
Neetai Tech
CVE-2020-36542

Demokratian install3.php privileges management

A vulnerability classified as critical has been found in Demokratian. This affects an unknown part of the file install/install3.php. The manipulation leads to privilege escalation. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

CVSS 3.1 · 7.3 High EPSS 1.4% KEV · Not listed
Vendors
Demokratian
Products
Demokratian