Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29904 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-18172 1 Trezor 1 Bridge 2024-11-21 9.8 Critical
A code injection vulnerability in the SeDebugPrivilege component of Trezor Bridge 2.0.27 allows attackers to escalate privileges.
CVE-2020-18170 1 Abloy 1 Key Manager 2024-11-21 9.8 Critical
An issue in the SeChangeNotifyPrivilege component of Abloy Key Manager Version 7.14301.0.0 allows attackers to escalate privileges via a change in permissions.
CVE-2020-18166 1 Laobancms 1 Laobancms 2024-11-21 9.8 Critical
Unrestricted File Upload in LAOBANCMS v2.0 allows remote attackers to upload arbitrary files by attaching a file with a ".jpg.php" extension to the component "admin/wenjian.php?wj=../templets/pc".
CVE-2020-18164 1 Tp-shop 1 Tp-shop 2024-11-21 9.8 Critical
SQL Injection vulnerability exists in tp-shop 2.x-3.x via the /index.php/home/api/shop fBill parameter.
CVE-2020-18155 1 Intelliants 1 Subrion 2024-11-21 9.8 Critical
SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
CVE-2020-18144 1 Ectouch 1 Ectouch 2024-11-21 9.8 Critical
SQL Injection Vulnerability in ECTouch v2 via the integral_min parameter in index.php.
CVE-2020-18114 1 Dedecms 1 Dedecms 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the /uploads/dede component of DedeCMS V5.7SP2 allows attackers to upload a webshell in HTM format.
CVE-2020-18106 1 Wms Project 1 Wms 2024-11-21 9.8 Critical
The GET parameter "id" in WMS v1.0 is passed without filtering, which allows attackers to perform SQL injection.
CVE-2020-18078 1 Sem-cms 1 Semcms 2024-11-21 9.8 Critical
A vulnerability in /include/web_check.php of SEMCMS v3.8 allows attackers to reset the Administrator account's password.
CVE-2020-18070 1 Idreamsoft 1 Icms 2024-11-21 9.1 Critical
Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php".
CVE-2020-18048 1 Bertanddip 1 Craigms 2024-11-21 9.8 Critical
An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.
CVE-2020-18020 1 Phpshe 1 Mall System 2024-11-21 9.8 Critical
SQL Injection in PHPSHE Mall System v1.7 allows remote attackers to execute arbitrary code by injecting SQL commands into the "user_phone" parameter of a crafted HTTP request to the "admin.php" component.
CVE-2020-18013 1 Whatsns 1 Whatsns 2024-11-21 9.8 Critical
SQL Injextion vulnerability exists in Whatsns 4.0 via the ip parameter in index.php?admin_banned/add.htm.
CVE-2020-17952 1 Twothink Project 1 Twothink 2024-11-21 9.8 Critical
A remote code execution (RCE) vulnerability in /library/think/App.php of Twothink v2.0 allows attackers to execute arbitrary PHP code.
CVE-2020-17752 1 Mon Project 1 Mon 2024-11-21 9.8 Critical
Integer overflow vulnerability in payable function of a smart contract implementation for an Ethereum token, as demonstrated by the smart contract implemented at address 0xB49E984A83d7A638E7F2889fc8328952BA951AbE, an implementation for MillionCoin (MON).
CVE-2020-17564 1 Feifeicms 1 Feifeicms 2024-11-21 9.1 Critical
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component.
CVE-2020-17563 1 Feifeicms 1 Feifeicms 2024-11-21 9.1 Critical
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id=".
CVE-2020-17531 1 Apache 1 Tapestry 2024-11-21 9.8 Critical
A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
CVE-2020-17523 1 Apache 1 Shiro 2024-11-21 9.8 Critical
Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVE-2020-17510 3 Apache, Debian, Redhat 3 Shiro, Debian Linux, Jboss Fuse 2024-11-21 9.8 Critical
Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.