Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (87349 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-42053 1 Tenda 2 W15e, W15e Firmware 2025-07-07 7.8 High
Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer parameter in the setPortMapping function.
CVE-2022-40846 1 Tenda 2 W15e, W15e Firmware 2025-07-07 4.8 Medium
In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execute JavaScript code via the applications stored hostname.
CVE-2022-40844 1 Tenda 2 W15e, W15e Firmware 2025-07-07 5.4 Medium
In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attacker to execute JavaScript code via the applications website filtering tab, specifically the URL body.
CVE-2025-40733 1 Code-projects 1 Daily Expense Manager 2025-07-07 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
CVE-2025-40734 1 Code-projects 1 Daily Expense Manager 2025-07-07 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
CVE-2025-25929 1 Openmrs 1 Openmrs 2025-07-07 5.4 Medium
A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter.
CVE-2024-53384 1 Egoist 1 Tsup 2025-07-07 5.1 Medium
A DOM Clobbering vulnerability in tsup v8.3.4 allows attackers to execute arbitrary code via a crafted script in the import.meta.url to document.currentScript in cjs_shims.js components
CVE-2024-53387 1 Umeditor Project 1 Umeditor 2025-07-07 8.8 High
A DOM Clobbering vulnerability in umeditor v1.2.3 allows attackers to execute arbitrary code via supplying a crafted HTML element.
CVE-2024-53388 1 Mavo 1 Mavo 2025-07-07 8.8 High
A DOM Clobbering vulnerability in mavo v0.3.2 allows attackers to execute arbitrary code via supplying a crafted HTML element.
CVE-2024-35285 1 Mitel 2 Micollab, Micollab Nupoint Messanger 2025-07-07 9.8 Critical
A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.
CVE-2025-6659 1 Pdf-xchange 3 Pdf-tools, Pdf-xchange Editor, Pdf-xchange Pro 2025-07-07 N/A
PDF-XChange Editor PRC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PRC files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26734.
CVE-2024-40089 1 Viloliving 3 Vilo 5, Vilo 5 Firmware, Vilo 5 Mesh Wifi System Firmware 2025-07-07 9.1 Critical
A Command Injection vulnerability in Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device.
CVE-2024-40088 2 Vilo, Viloliving 3 5 Mesh Wifi System, Vilo 5, Vilo 5 Firmware 2025-07-07 5.3 Medium
A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthenticated attackers to enumerate the existence and length of any file in the filesystem by placing malicious payloads in the path of any HTTP request.
CVE-2024-48233 1 Mipjz Project 1 Mipjz 2025-07-07 4.8 Medium
mipjz 5.0.5 is vulnerable to Cross Site Scripting (XSS) in \app\setting\controller\ApiAdminSetting.php via the ICP parameter.
CVE-2021-3186 1 Tenda 2 Ac5, Ac5 Firmware 2025-07-07 5.4 Medium
A Stored Cross-site scripting (XSS) vulnerability in /main.html Wifi Settings in Tenda AC5 AC1200 version V15.03.06.47_multi allows remote attackers to inject arbitrary web script or HTML via the Wifi Name parameter.
CVE-2024-51091 1 Seajs 1 Seajs 2025-07-07 5.4 Medium
Cross Site Scripting vulnerability in seajs v.2.2.3 allows a remote attacker to execute arbitrary code via the seajs package
CVE-2024-48192 1 Tenda 2 G3, G3 Firmware 2025-07-07 8 High
Tenda G3 v15.01.0.5(2848_755)_EN was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root
CVE-2024-51568 2 Cyber Panel, Cyberpanel 2 Cyber Panel, Cyberpanel 2025-07-07 10 Critical
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.
CVE-2024-50983 1 Getflightpath 1 Flightpath 2025-07-07 6.1 Medium
FlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user by including a malicious payload into the Last Name section in the Create/Edit Faculty/Staff User or Create/Edit Student User sections.
CVE-2024-6165 1 Wanotifier 1 Wanotifier 2025-07-07 4.8 Medium
The WANotifier WordPress plugin before 2.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)