Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (366857 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-43161 1 Ruijienetworks 6 Reyeeos, Rg-ew1200, Rg-ew1200g Pro and 3 more 2024-11-21 8.8 High
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the doSwitchApi function in /cgi-bin/luci/api/switch.
CVE-2021-43160 1 Ruijienetworks 6 Reyeeos, Rg-ew1200, Rg-ew1200g Pro and 3 more 2024-11-21 8.8 High
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the switchFastDhcp function in /cgi-bin/luci/api/diagnose.
CVE-2021-43159 1 Ruijienetworks 6 Reyeeos, Rg-ew1200, Rg-ew1200g Pro and 3 more 2024-11-21 8.8 High
A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the setSessionTime function in /cgi-bin/luci/api/common..
CVE-2021-43156 1 Projectworlds 1 Online Book Store Project In Php 2024-11-21 6.5 Medium
In ProjectWorlds Online Book Store PHP 1.0 a CSRF vulnerability in admin_delete.php allows a remote attacker to delete any book.
CVE-2021-43155 1 Projectworlds 1 Online Book Store Project In Php 2024-11-21 9.8 Critical
Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php.
CVE-2021-43154 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
CVE-2021-43145 1 Zammad 1 Zammad 2024-11-21 8.1 High
With certain LDAP configurations, Zammad 5.0.1 was found to be vulnerable to unauthorized access with existing user accounts.
CVE-2021-43142 1 Jox Project 1 Jox 2024-11-21 9.8 Critical
An XML External Entity (XXE) vulnerability exists in wuta jox 1.16 in the readObject method in JOXSAXBeanInput.
CVE-2021-43138 3 Async Project, Fedoraproject, Redhat 4 Async, Fedora, Rhmt and 1 more 2024-11-21 7.8 High
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
CVE-2021-43137 1 Phpgurukul 1 Hostel Management System 2024-11-21 8.8 High
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.
CVE-2021-43136 1 Formalms 1 Formalms 2024-11-21 9.8 Critical
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.
CVE-2021-43130 1 Customer Relationship Management System Project 1 Customer Relationship Management System 2024-11-21 9.8 Critical
An SQL Injection vulnerability exists in Sourcecodester Customer Relationship Management System (CRM) 1.0 via the username parameter in customer/login.php.
CVE-2021-43129 1 D2l 1 Brightspace 2024-11-21 6.5 Medium
A bypass exists for Desire2Learn/D2L Brightspace’s “Disable Right Click” option in the quizzing feature, which allows a quiz-taker to access print and copy functionality via the browser’s right click menu even when “Disable Right Click” is enabled on the quiz.
CVE-2021-43118 1 Draytek 6 Vigor2960, Vigor2960 Firmware, Vigor300b and 3 more 2024-11-21 9.8 Critical
A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3, DrayTek Vigor 3900 1.5.1.3, and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi, which could let a remote malicious user execute arbitrary code.
CVE-2021-43117 1 Fastadmin 1 Fastadmin 2024-11-21 9.8 Critical
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.
CVE-2021-43116 1 Alibaba 1 Nacos 2024-11-21 8.8 High
An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
CVE-2021-43114 2 Debian, Fort Validator Project 2 Debian Linux, Fort Validator 2024-11-21 7.5 High
FORT Validator versions prior to 1.5.2 will crash if an RPKI CA publishes an X.509 EE certificate. This will lead to RTR clients such as BGP routers to lose access to the RPKI VRP data set, effectively disabling Route Origin Validation.
CVE-2021-43110 1 Puneethreddyhc Online-shopping-system Project 1 Puneethreddyhc Online-shopping-system 2024-11-21 9.8 Critical
An Access Conrol vulnerability exists in PuneethReddyHC online-shopping-system as of 11/01/2021 in add_products.
CVE-2021-43109 1 Puneethreddyhc Online-shopping-system Project 1 Puneethreddyhc Online-shopping-system 2024-11-21 7.5 High
An SQL Injection vulnerability exits in PuneethReddyHC online-shopping-system as of 11/01/2021 via the p parameter in product.php.
CVE-2021-43106 1 Compassplus 2 Tranzware Online, Tranzware Online Financial Institution Maintenance Interface 2024-11-21 6.1 Medium
A Header Injection vulnerability exists in Compass Plus TranzWare Online FIMI Web Interface Tranzware Online (TWO) 5.3.33.3 F38 and FIMI 4.2.19.4 25.The HTTP host header can be manipulated and cause the application to behave in unexpected ways. Any changes made to the header would just cause the request to be sent to a completely different Domain/IP address. This is due to that the server implicitly trusts the Host header, and fails to validate or escape it properly. An attacker can use this input to redirect target users to a malicious domain/web page. This would result in expanding the potential to further attacks and malicious actions.