Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43839 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-13589 1 Anjlab 1 Paranoid2 2024-11-21 N/A
The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
CVE-2019-13578 1 Givewp 1 Givewp 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in the Impress GiveWP Give plugin through 2.5.0 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/payments/class-payments-query.php.
CVE-2019-13575 1 Wpeverest 1 Everest Forms 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via includes/evf-entry-functions.php
CVE-2019-13573 1 Foliovision 1 Fv Flowplayer Video Player 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in the FolioVision FV Flowplayer Video Player plugin before 7.3.19.727 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
CVE-2019-13572 1 Adenion 1 Blog2social 2024-11-21 9.8 Critical
The Adenion Blog2Social plugin through 5.5.0 for WordPress allows SQL Injection.
CVE-2019-13571 1 Vsourz 1 Advanced Cf7 Db 2024-11-21 9.8 Critical
A SQL injection vulnerability exists in the Vsourz Digital Advanced CF7 DB plugin through 1.6.1 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
CVE-2019-13570 1 Ajdg 1 Adrotate 2024-11-21 N/A
The AJdG AdRotate plugin before 5.3 for WordPress allows SQL Injection.
CVE-2019-13569 1 Icegram 1 Email Subscribers \& Newsletters 2024-11-21 N/A
A SQL injection vulnerability exists in the Icegram Email Subscribers & Newsletters plugin through 4.1.7 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system.
CVE-2019-13547 1 Advantech 1 Wise-paas\/rmm 2024-11-21 9.8 Critical
Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecured function that allows anyone who can access the IP address to use the function without authentication.
CVE-2019-13507 1 Hidea 1 Az Admin 2024-11-21 N/A
hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection.
CVE-2019-13489 1 Trape Project 1 Trape 2024-11-21 N/A
Trape through 2019-05-08 has SQL injection via the data[2] variable in core/db.py, as demonstrated by the /bs t parameter.
CVE-2019-13475 1 Mobatek 1 Mobaxterm 2024-11-21 N/A
In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute arbitrary commands. The additional arguments -hideterm and -exitwhendone in the payload make the attack less visible.
CVE-2019-13462 1 Lansweeper 1 Lansweeper 2024-11-21 N/A
Lansweeper before 7.1.117.4 allows unauthenticated SQL injection.
CVE-2019-13453 1 Zipios Project 1 Zipios 2024-11-21 N/A
Zipios before 0.1.7 does not properly handle certain malformed zip archives and can go into an infinite loop, causing a denial of service. This is related to zipheadio.h:readUint32() and zipfile.cpp:Zipfile::Zipfile().
CVE-2019-13450 2 Ringcentral, Zoom 2 Ringcentral, Zoom 2024-11-21 N/A
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.
CVE-2019-13447 1 Sertek 1 Xpare 2024-11-21 N/A
An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this, a malicious agent could access the backend database via SQL injection.
CVE-2019-13417 1 Search-guard 1 Search Guard 2024-11-21 5.3 Medium
Search Guard versions before 24.0 had an issue that field caps and mapping API leak field names (but not values) for fields which are not allowed for the user when field level security (FLS) is activated.
CVE-2019-13413 1 Boiteasite 1 Rencontre 2024-11-21 9.8 Critical
The Rencontre plugin before 3.1.3 for WordPress allows SQL Injection via inc/rencontre_widget.php.
CVE-2019-13409 1 Topmeeting 1 Topmeeting 2024-11-21 9.8 Critical
A SQL injection vulnerability was discovered in TOPMeeting before version 8.8 (2019/08/19). An attacker can use a union based injection query string though a search meeting room feature to get databases schema and username/password.
CVE-2019-13408 2 Androvideo, Geovision 6 Vd 1, Vd 1 Firmware, Gv-vd8700 and 3 more 2024-11-21 7.5 High
A relative path traversal vulnerability found in Advan VD-1 firmware versions up to 230. It allows attackers to download arbitrary files via url cgibin/ExportSettings.cgi?Download=filepath, without any authentication.