Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (25719 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-45509 1 Misp 1 Misp 2024-09-04 9.8 Critical
In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin.
CVE-2024-45508 2 Htmldoc, Htmldoc Project 2 Htmldoc, Htmldoc 2024-09-04 9.8 Critical
HTMLDOC before 1.9.19 has an out-of-bounds write in parse_paragraph in ps-pdf.cxx because of an attempt to strip leading whitespace from a whitespace-only node.
CVE-2024-41364 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\trackEdit.php
CVE-2024-41366 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\userScripts.php
CVE-2024-41367 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\api\playlist\appendFileToPlaylist.php
CVE-2024-41368 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWlanIpMail.php
CVE-2024-41361 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\manageFilesFolders.php
CVE-2024-41369 1 Sourcefabric 2 Phoniebox, Rpi-jukebox-rfid 2024-09-04 9.8 Critical
RPi-Jukebox-RFID v2.7.0 was discovered to contain a remote code execution (RCE) vulnerability via htdocs\inc.setWifi.php
CVE-2024-41372 2 Causefx, Organizr 2 Organizr, Organizr 2024-09-04 9.8 Critical
Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/settyping.php.
CVE-2024-41370 2 Causefx, Organizr 2 Organizr, Organizr 2024-09-04 9.8 Critical
Organizr v1.90 was discovered to contain a SQL injection vulnerability via chat/setlike.php.
CVE-2024-44921 1 Seacms 1 Seacms 2024-09-04 9.8 Critical
SeaCMS v12.9 was discovered to contain a SQL injection vulnerability via the id parameter at /dmplayer/dmku/index.php?ac=del.
CVE-2024-43941 1 Propovoice 2 Propovoice, Propovoice Pro 2024-09-04 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Propovoice Propovoice Pro allows SQL Injection.This issue affects Propovoice Pro: from n/a through 1.7.0.3.
CVE-2024-43773 2 Easytest, Huaju 2 Easytest Online Test Platform, Easytest Online Learning Test Platform 2024-09-04 9.8 Critical
SQL Injection in download class learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the cstr parameter.
CVE-2024-45588 1 Symphonyfintech 2 Xts Mobile Trader, Xts Web Trader 2024-09-04 8.1 High
This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Preference module of the application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized access and modification of sensitive information belonging to other users.
CVE-2024-45587 1 Symphonyfintech 2 Xts Mobile Trader, Xts Web Trader 2024-09-04 8.8 High
This vulnerability exists in Symphony XTS Web Trading platform version 2.0.0.1_P160 due to improper access controls on APIs in the Transaction module of vulnerable application. An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to compromise of other user accounts.
CVE-2024-45586 1 Symphonyfintech 2 Xts Mobile Trader, Xts Web Trader 2024-09-04 8.8 High
This vulnerability exists due to improper access controls on APIs in the Authentication module of Symphony XTS Web Trading and Mobile Trading platforms (version 2.0.0.1_P160). An authenticated remote attacker could exploit this vulnerability by manipulating parameters through HTTP request which could lead to unauthorized account take over belonging to other users.
CVE-2024-43772 2 Easytest, Huaju 2 Easytest Online Test Platform, Easytest Online Learning Test Platform 2024-09-04 9.8 Critical
SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter.
CVE-2024-42568 1 Arajajyothibabu 1 School Management System 2024-09-03 9.8 Critical
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.
CVE-2024-45435 2 Chartist, Chartistjs 2 Chartist, Chartist 2024-09-03 9.8 Critical
Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function.
CVE-2024-6118 1 Hamastar 1 Meetinghub Paperless Meetings 2024-08-30 9.1 Critical
A Plaintext Storage of a Password vulnerability in ebooknote function in Hamastar MeetingHub Paperless Meetings 2021 allows remote attackers to obtain the other users’ credentials and gain access to the product via an XML file.