Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (49462 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-15051 1 Teampass 1 Teampass 2025-04-20 N/A
Multiple stored cross-site scripting (XSS) vulnerabilities in TeamPass before 2.1.27.9 allow authenticated remote attackers to inject arbitrary web script or HTML via the (1) URL value of an item or (2) user log history. To exploit the vulnerability, the attacker must be first authenticated to the application. For the first one, the attacker has to simply inject XSS code within the URL field of a shared item. For the second one however, the attacker must prepare a payload within its profile, and then ask an administrator to modify its profile. From there, whenever the administrator accesses the log, it can be XSS'ed.
CVE-2016-4875 3 Assist Project, Databox Project, Userbox Project 3 Assist Plugin, Databox Plugin, Userbox Plugin 2025-04-20 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the IVYWE (1) Assist plugin before 1.1.2.test20160906, (2) dataBox plugin before 0.0.0.20160906, and (3) userBox plugin before 0.0.0.20160906 for Geeklog allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2016-1560 1 Exagrid 16 Ex10000e, Ex10000e Firmware, Ex13000e and 13 more 2025-04-20 N/A
ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.
CVE-2017-1113 1 Ibm 1 Rational Team Concert 2025-04-20 N/A
IBM Rational Team Concert (RTC) 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 121151.
CVE-2016-6347 1 Redhat 1 Resteasy 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-1000011 1 Mywebsql 1 Mywebsql 2025-04-20 N/A
MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information
CVE-2017-14126 1 Xnau 1 Participants Database 2025-04-20 N/A
The Participants Database plugin before 1.7.5.10 for WordPress has XSS.
CVE-2015-6540 1 Igcb 1 Intellect Digital Core 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Intellect Design Arena Intellect Core banking software.
CVE-2017-1133 1 Ibm 2 Qradar Incident Forensics, Qradar Security Information And Event Manager 2025-04-20 N/A
IBM QRadar 7.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM Reference #: 1999534.
CVE-2016-9257 1 F5 1 Big-ip Access Policy Manager 2025-04-20 N/A
In F5 BIG-IP APM 12.0.0 through 12.1.2, non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs, allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.
CVE-2016-9260 1 Tenable 1 Nessus 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files.
CVE-2017-15890 1 Synology 1 Mailplus Server 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Disclaimer in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary web script or HTML via the NAME parameter.
CVE-2017-1000005 1 Phpminiadmin Project 1 Phpminiadmin 2025-04-20 N/A
PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases, tables and columns resulting in potential account takeover and scraping of data (stealing data).
CVE-2017-12811 1 Stivasoft 1 Phpjabbers Star Rating Script 2025-04-20 N/A
PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.
CVE-2017-14371 1 Rsa 1 Archer Grc Platform 2025-04-20 N/A
RSA Archer GRC Platform prior to 6.2.0.5 is affected by reflected cross-site scripting via the request URL. Attackers could potentially exploit this to execute arbitrary HTML in the user's browser session in the context of the affected RSA Archer application.
CVE-2017-12813 1 Stivasoft 1 Phpjabbers File Sharing Script 2025-04-20 N/A
PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.
CVE-2017-1000012 1 Mysqldumper 1 Mysqldumper 2025-04-20 N/A
MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user
CVE-2017-12860 1 Epson 1 Easymp 2025-04-20 N/A
The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-digit code, displayed on-screen - ensuring only those who can view it are streaming.In addition to the password, each projector has a hardcoded "backdoor" code (2270), which authenticates to all devices.
CVE-2017-1365 1 Ibm 7 Rational Collaborative Lifecycle Management, Rational Doors Next Generation, Rational Engineering Lifecycle Manager and 4 more 2025-04-20 N/A
IBM Team Concert (RTC including IBM Rational Collaborative Lifecycle Management 4.0, 5.0., and 6.0) is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-force ID: 126858.
CVE-2017-14134 1 Maplesoft 1 Maple T.a. 2025-04-20 N/A
A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 (Customer Hosted) via the emailAddress parameter to passwordreset/PasswordReset.do, aka Open Bug Bounty ID OBB-286688.