Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323441 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-25516 1 Wso2 1 Enterprise Integrator 2024-11-21 5.4 Medium
WSO2 Enterprise Integrator 6.6.0 or earlier contains a stored cross-site scripting (XSS) vulnerability in BPMN explorer tasks.
CVE-2020-25515 1 Simple Library Management System Project 1 Simple Library Management System 2024-11-21 7.8 High
Sourcecodester Simple Library Management System 1.0 is affected by Insecure Permissions via Books > New Book , http://<site>/lms/index.php?page=books.
CVE-2020-25514 1 Simple Library Management System Project 1 Simple Library Management System 2024-11-21 8.4 High
Sourcecodester Simple Library Management System 1.0 is affected by Incorrect Access Control via the Login Panel, http://<site>/lms/admin.php.
CVE-2020-25507 1 3ds 1 Teamwork Cloud 2024-11-21 7.8 High
An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).
CVE-2020-25499 1 Totolink 26 A3002r, A3002r Firmware, A3002ru-v1 and 23 more 2024-11-21 8.8 High
TOTOLINK A3002RU-V2.0.0 B20190814.1034 allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router.
CVE-2020-25498 1 Beetel 2 777vr1, 777vr1 Firmware 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and "Keyword" in URL Filter.
CVE-2020-25495 1 Xinuos 1 Openserver 2024-11-21 6.1 Medium
A reflected Cross-site scripting (XSS) vulnerability in Xinuo (formerly SCO) Openserver version 5 and 6 allows remote attackers to inject arbitrary web script or HTML tag via the parameter 'section'.
CVE-2020-25494 1 Xinuos 1 Openserver 2024-11-21 9.8 Critical
Xinuos (formerly SCO) Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook.
CVE-2020-25493 1 Oclean 1 Oclean 2024-11-21 7.5 High
Oclean Mobile Application 2.1.2 communicates with an external website using HTTP so it is possible to eavesdrop the network traffic. The content of HTTP payload is encrypted using XOR with a hardcoded key, which allows for the possibility to decode the traffic.
CVE-2020-25491 1 6kare 1 Emakin 2024-11-21 6.1 Medium
6Kare Emakin 5.0.341.0 is affected by Cross Site Scripting (XSS) via the /rpc/membership/setProfile DisplayName field, which is mishandled when rendering the Activity Stream page.
CVE-2020-25490 1 Sqreen 1 Php Microagent 2024-11-21 7.3 High
Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution inside the virtual machine.
CVE-2020-25489 1 Sqreen 1 Python Mini Racer 2024-11-21 9.8 Critical
A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption.
CVE-2020-25487 1 Phpgurukul 1 Zoo Management System 2024-11-21 7.8 High
PHPGURUKUL Zoo Management System Using PHP and MySQL version 1.0 is affected by: SQL Injection via zms/animal-detail.php.
CVE-2020-25483 1 Ucms Project 1 Ucms 2024-11-21 9.8 Critical
An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server.
CVE-2020-25476 1 Liferay 1 Liferay Portal 2024-11-21 6.1 Medium
Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to Calendar. An attacker can insert the malicious payload on the username, lastname or surname fields of its own profile, and the malicious payload will be injected and reflected in the calendar of the user who submitted the payload. An attacker could escalate its privileges in case an admin visits the calendar that injected the payload.
CVE-2020-25475 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 9.8 Critical
SimplePHPscripts News Script PHP Pro 2.3 is affected by a SQL Injection via the id parameter in an editNews action.
CVE-2020-25474 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 6.1 Medium
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.
CVE-2020-25473 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 6.5 Medium
SimplePHPscripts News Script PHP Pro 2.3 does not properly set the HttpOnly Flag from Session Cookies.
CVE-2020-25472 1 Newsscriptphp 1 News Script Php Pro 2024-11-21 6.5 Medium
SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Request Forgery (CSRF) vulnerability, which allows attackers to add new users.
CVE-2020-25470 1 Antsword Project 1 Antsword 2024-11-21 6.1 Medium
AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead to remote code execution.