Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347766 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-25598 1 Apache 1 Dolphinscheduler 2024-11-21 7.5 High
Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
CVE-2022-25597 1 Asus 2 Rt-ac86u, Rt-ac86u Firmware 2024-11-21 8.8 High
ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service.
CVE-2022-25596 1 Asus 2 Rt-ac86u, Rt-ac86u Firmware 2024-11-21 8.8 High
ASUS RT-AC56U’s configuration function has a heap-based buffer overflow vulnerability due to insufficient validation for the decryption parameter length, which allows an unauthenticated LAN attacker to execute arbitrary code, perform arbitrary operations and disrupt service.
CVE-2022-25595 1 Asus 2 Rt-ac86u, Rt-ac86u Firmware 2024-11-21 6.5 Medium
ASUS RT-AC86U has improper user request handling, which allows an unauthenticated LAN attacker to cause a denial of service by sending particular request a server-to-client reply attempt.
CVE-2022-25594 1 Program 1 Parking Lot Management System 2024-11-21 5.3 Medium
Microprogram’s parking lot management system is vulnerable to sensitive information exposure. An unauthorized remote attacker can input specific URLs to acquire partial system configuration information.
CVE-2022-25591 1 Blogengine 1 Blogengine.net 2024-11-21 9.1 Critical
BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web server root directory via a crafted HTTP request.
CVE-2022-25590 1 Surveyking 1 Surveyking 2024-11-21 6.5 Medium
SurveyKing v0.2.0 was discovered to retain users' session cookies after logout, allowing attackers to login to the system and access data using the browser cache when the user exits the application.
CVE-2022-25585 1 Unioncms Project 1 Unioncms 2024-11-21 5.4 Medium
Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings.
CVE-2022-25584 1 Flexwatch 2 Fw3170-ps-e, Fw3170-ps-e Firmware 2024-11-21 7.5 High
Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information.
CVE-2022-25582 1 Classcms Project 1 Classcms 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Column module of ClassCMS v2.5 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Articles field.
CVE-2022-25581 1 Classcms 1 Classcms 2024-11-21 7.8 High
Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection via a crafted .txt file.
CVE-2022-25578 1 Taogogo 1 Taocms 2024-11-21 9.8 Critical
taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.
CVE-2022-25577 1 Alf-banco 1 Alf-banco 2024-11-21 9.1 Critical
ALF-BanCO v8.2.5 and below was discovered to use a hardcoded password to encrypt the SQLite database containing the user's data. Attackers who are able to gain remote or local access to the system are able to read and modify the data.
CVE-2022-25576 1 Anchorcms 1 Anchor Cms 2024-11-21 4.5 Medium
Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
CVE-2022-25575 1 Hongmen 1 Parking Management System 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes.
CVE-2022-25574 1 Douco 1 Douphp 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the upload function of /admin/show.php allows attackers to execute arbitrary web scripts or HTML via a crafted image file.
CVE-2022-25571 1 Bluedon 1 Internet Access Detector 2024-11-21 7.5 High
Bluedon Information Security Technologies Co.,Ltd Internet Access Detector v1.0 was discovered to contain an information leak which allows attackers to access the contents of the password file via unspecified vectors.
CVE-2022-25570 1 Clickstudios 1 Passwordstate 2024-11-21 6.5 Medium
In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifically, an authenticated user who has write permissions to a password list in one folder (with the default permission model) can extend his permissions to all other password lists in the same folder.
CVE-2022-25569 1 Bettinivideo 1 Sgsetup 2024-11-21 9.8 Critical
Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users via extracting a key from the software.
CVE-2022-25568 1 Motioneye Project 1 Motioneye 2024-11-21 7.5 High
MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured.