Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (371183 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-29652 1 Online Sports Complex Booking System Project 1 Online Sports Complex Booking System 2024-11-21 6.1 Medium
Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client.
CVE-2022-29649 1 Qsmart Next Project 1 Qsmart Next 2024-11-21 6.1 Medium
Qsmart Next v4.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability.
CVE-2022-29648 1 Jflyfox 1 Jfinal Cms 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.
CVE-2022-29647 1 Mingsoft 1 Mcms 2024-11-21 8.8 High
An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVE-2022-29646 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 5.3 Medium
An access control issue in TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 allows attackers to obtain sensitive information via a crafted web request.
CVE-2022-29645 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for root stored in the component /etc/shadow.sample.
CVE-2022-29644 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 9.8 Critical
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a hard coded password for the telnet service stored in the component /web_cste/cgi-bin/product.ini.
CVE-2022-29643 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 7.5 High
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the macAddress parameter in the function setMacQos. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2022-29642 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 7.5 High
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the url parameter in the function setUrlFilterRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2022-29641 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 7.5 High
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the startTime and endTime parameters in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2022-29640 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 7.5 High
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setPortForwardRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2022-29639 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 8.1 High
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a command injection vulnerability via the magicid parameter in the function uci_cloudupdate_config.
CVE-2022-29638 1 Totolink 2 A3100r, A3100r Firmware 2024-11-21 7.5 High
TOTOLINK A3100R V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129 were discovered to contain a stack overflow via the comment parameter in the function setIpQosRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2022-29637 1 Iminho 1 Mindoc 2024-11-21 7.8 High
An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.
CVE-2022-29633 1 Linglong Project 1 Linglong 2024-11-21 9.8 Critical
An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie.
CVE-2022-29632 1 Roncoo 1 Roncoo-education 2024-11-21 9.8 Critical
An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a crafted file.
CVE-2022-29631 1 Jodd 1 Jodd Http 2024-11-21 7.5 High
Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
CVE-2022-29628 1 Online Market Place Site Project 1 Online Market Place Site 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts or HTML via a crafted payload injected into the Page parameter.
CVE-2022-29627 1 Online Market Place Site Project 1 Online Market Place Site 2024-11-21 4.3 Medium
An insecure direct object reference (IDOR) in Online Market Place Site v1.0 allows attackers to modify products that are owned by other sellers.
CVE-2022-29624 1 Tpcms Project 1 Tpcms 2024-11-21 8.8 High
An arbitrary file upload vulnerability in the Add File function of TPCMS v3.2 allows attackers to execute arbitrary code via a crafted PHP file.