Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357543 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-38802 5 Debian, Fedoraproject, Frrouting and 2 more 9 Debian Linux, Fedora, Frrouting and 6 more 2024-11-21 7.5 High
FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).
CVE-2023-38773 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp1 and volopp2 parameters within the /QueryView.php.
CVE-2023-38771 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the volopp parameter within the /QueryView.php.
CVE-2023-38770 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the group parameter within the /QueryView.php.
CVE-2023-38769 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the searchstring and searchwhat parameters within the /QueryView.php.
CVE-2023-38768 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the PropertyID parameter within the /QueryView.php.
CVE-2023-38767 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the 'value' and 'custom' parameters within the /QueryView.php.
CVE-2023-38766 1 Churchcrm 1 Churchcrm 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.
CVE-2023-38765 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the membermonth parameter within the /QueryView.php.
CVE-2023-38764 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the birthmonth and percls parameters within the /QueryView.php.
CVE-2023-38763 1 Churchcrm 1 Churchcrm 2024-11-21 6.5 Medium
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.
CVE-2023-38762 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the friendmonths parameter within the /QueryView.php.
CVE-2023-38761 1 Churchcrm 1 Churchcrm 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.
CVE-2023-38760 1 Churchcrm 1 Churchcrm 2024-11-21 7.5 High
SQL injection vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to obtain sensitive information via the role and gender parameters within the /QueryView.php component.
CVE-2023-38759 1 Wger 1 Workout Manager 2024-11-21 8.8 High
Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges via the user-management feature in the gym/views/gym.py, templates/gym/reset_user_password.html, templates/user/overview.html, core/views/user.py, and templates/user/preferences.html, core/forms.py components.
CVE-2023-38758 1 Wger 1 Workout Manager 2024-11-21 5.4 Medium
Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/ingredients.py components.
CVE-2023-38752 1 Jpcert 1 Special Interest Group Network For Analysis And Liaison 2024-11-21 4.3 Medium
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the attribute information of the poster that is set as"non-disclosure" in the system settings.
CVE-2023-38751 1 Jpcert 1 Special Interest Group Network For Analysis And Liaison 2024-11-21 4.3 Medium
Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorized API users to view the organization information of the information receiver that is set as "non-disclosure" in the information provision operation.
CVE-2023-38750 1 Zimbra 1 Zimbra 2024-11-21 7.5 High
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.
CVE-2023-38748 1 Omron 1 Cx-programmer 2024-11-21 7.8 High
Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier. By having a user open a specially crafted CXP file, information disclosure and/or arbitrary code execution may occur.