Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (50584 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2016-10203 1 Zoneminder 1 Zoneminder 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Zoneminder 1.30 and earlier allows remote attackers to inject arbitrary web script or HTML via the name when creating a new monitor.
CVE-2017-1245 1 Ibm 1 Rational Software Architect Design Manager 2025-04-20 N/A
IBM Rational Software Architect Design Manager 5.0 and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 124580.
CVE-2015-7357 1 Udesign Project 1 Udesign 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in the uDesign (aka U-Design) theme 2.3.0 before 2.7.10 for WordPress allows remote attackers to inject arbitrary web script or HTML via a fragment identifier, as demonstrated by #<svg onload=alert(1)>.
CVE-2015-3169 1 Askbot 1 Askbot 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in askbot 0.7.51-4.el6.noarch.
CVE-2017-12366 1 Cisco 1 Webex Meeting Center 2025-04-20 N/A
A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvf78635,, CSCvg52440.
CVE-2015-7347 1 Zcms Project 1 Zcms 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in ZCMS JavaServer Pages Content Management System 1.1.
CVE-2015-7324 1 Stackideas 1 Komento 2025-04-20 N/A
Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) img or (2) url tag of a new comment.
CVE-2017-12413 1 Axis 2 2100 Network Camera, 2100 Network Camera Firmware 2025-04-20 N/A
AXIS 2100 devices 2.43 have XSS via the URI, possibly related to admin/admin.shtml.
CVE-2015-7316 1 Plone 1 Plone 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
CVE-2015-8310 1 Fomori 1 Cherrymusic 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Cherry Music before 0.36.0 allows remote authenticated users to inject arbitrary web script or HTML via the playlistname field when creating a new playlist.
CVE-2017-7896 1 Trendmicro 1 Interscan Messaging Security Virtual Appliance 2025-04-20 N/A
Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.
CVE-2017-7723 1 Wp-ecommerce 1 Easy Wp Smtp 2025-04-20 N/A
XSS exists in Easy WP SMTP (before 1.2.5), a WordPress Plugin, via the e-mail subject or body.
CVE-2017-5612 2 Debian, Wordpress 2 Debian Linux, Wordpress 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in wp-admin/includes/class-wp-posts-list-table.php in the posts list table in WordPress before 4.7.2 allows remote attackers to inject arbitrary web script or HTML via a crafted excerpt.
CVE-2016-3101 1 Jenkins 1 Extra Columns 2025-04-20 5.4 Medium
Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web script or HTML by leveraging failure to filter tool tips through the configured markup formatter.
CVE-2017-14379 1 Emc 1 Rsa Authentication Manager 2025-04-20 N/A
EMC RSA Authentication Manager before 8.2 SP1 P6 has a cross-site scripting vulnerability that could potentially be exploited by malicious users to compromise the affected system.
CVE-2017-7339 1 Fortinet 1 Fortiportal 2025-04-20 N/A
A Cross-Site Scripting vulnerability in Fortinet FortiPortal versions 4.0.0 and below allows an attacker to execute unauthorized code or commands via the 'Name' and 'Description' inputs in the 'Add Revision Backup' functionality.
CVE-2015-6027 1 Castlerock 1 Snmpc 2025-04-20 6.1 Medium
Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.
CVE-2017-8298 1 Cnvs 1 Canvas 2025-04-20 N/A
cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts > Add New" action, and during creation of new tags and users.
CVE-2017-7732 1 Fortinet 1 Fortimail 2025-04-20 N/A
A reflected Cross-Site Scripting (XSS) vulnerability in Fortinet FortiMail 5.1 and earlier, 5.2.0 through 5.2.9, and 5.3.0 through 5.3.9 customized pre-authentication webmail login page allows attacker to inject arbitrary web script or HTML via crafted HTTP requests.
CVE-2017-7309 1 Mantisbt 1 Mantisbt 2025-04-20 N/A
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.