Search vulnerabilities

Expected end of text, found ':' (at char 31), (line:1, col:32)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,880

CVE-2022-28927

A remote code execution (RCE) vulnerability in Subconverter v0.7.2 allows attackers to execute arbitrary code via crafted config and url parameters.

CVSS 3.1 · 9.8 Critical EPSS 34.4% KEV · Not listed
Vendors
Subconverter Project
Products
Subconverter
CVE-2022-28924

An information disclosure vulnerability in UniverSIS-Students before v1.5.0 allows attackers to obtain sensitive information via a crafted GET request to the endpoint /api/students/me/courses/.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Universis
Products
Universis-students
CVE-2022-28921

A Cross-Site Request Forgery (CSRF) vulnerability discovered in BlogEngine.Net v3.3.8.0 allows unauthenticated attackers to read arbitrary files on the hosting web server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Blogengine
Products
Blogengine.net
CVE-2022-28920

Tieba-Cloud-Sign v4.9 was discovered to contain a cross-site scripting (XSS) vulnerability via the function strip_tags.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Moecraft
Products
Tieba-cloud-sign
CVE-2022-28919

HTMLCreator release_stable_2020-07-29 was discovered to contain a cross-site scripting (XSS) vulnerability via the function _generateFilename.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Dokuwiki Fedoraproject
Products
Dokuwiki Fedora
CVE-2022-28918

GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=.

CVSS 3.1 · 8.1 High EPSS 1.1% KEV · Not listed
Vendors
Njtech
Products
Greencms
CVE-2022-28917

Tenda AX12 v22.03.01.21_cn was discovered to contain a stack overflow via the lanIp parameter in /goform/AdvSetLanIp.

CVSS 3.1 · 7.5 High EPSS 9.6% KEV · Not listed
Vendors
Tenda
Products
Ax12 Ax12 Firmware
CVE-2022-28915

D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a command injection vulnerability via the admuser and admpass parameters in /goform/setSysAdm.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed
Vendors
Dlink
Products
Dir-816 Dir-816 Firmware
CVE-2022-28913

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUploadSetting.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28912

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/setUpgradeFW.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28911

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the filename parameter in /setting/CloudACMunualUpdate.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28910

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicename parameter in /setting/setDeviceName.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28909

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the webwlanidx parameter in /setting/setWebWlanIdx.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28908

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the ipdoamin parameter in /setting/setDiagnosisCfg.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28907

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the hosttime function in /setting/NTPSyncWithHost.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28906

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg.

CVSS 3.1 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28905

TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the devicemac parameter in /setting/setDeviceName.

CVSS 3.1 · 9.8 Critical EPSS 2.5% KEV · Not listed
Vendors
Totolink
Products
N600r N600r Firmware
CVE-2022-28901

A command injection vulnerability in the component /SetTriggerLEDBlink/Blink of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Dlink
Products
Dir-882 Dir-882 Firmware
CVE-2022-28896

A command injection vulnerability in the component /setnetworksettings/SubnetMask of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Dlink
Products
Dir-882 Dir-882 Firmware
CVE-2022-28895

A command injection vulnerability in the component /setnetworksettings/IPAddress of D-Link DIR882 DIR882A1_FW130B06 allows attackers to escalate privileges to root via a crafted payload.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Dlink
Products
Dir-882 Dir-882 Firmware