Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88144 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-42985 1 Scratch-wiki 1 Scratch Login 2025-04-25 4.8 Medium
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
CVE-2022-38147 1 Silverstripe 1 Framework 2025-04-25 5.4 Medium
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).
CVE-2022-38145 1 Silverstripe 1 Framework 2025-04-25 5.4 Medium
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.
CVE-2022-37430 1 Silverstripe 1 Framework 2025-04-25 5.4 Medium
Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2).
CVE-2022-37429 1 Silverstripe 1 Framework 2025-04-25 5.4 Medium
Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL with white space characters.
CVE-2022-37421 1 Silverstripe 1 Silverstripe 2025-04-25 5.4 Medium
Silverstripe silverstripe/cms through 4.11.0 allows XSS.
CVE-2022-36337 1 Insyde 1 Kernel 2025-04-25 8.2 High
An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration driver leads to arbitrary code execution. Control of a UEFI variable under the OS can cause this overflow when read by BIOS code.
CVE-2020-23584 1 Optilinknetwork 2 Op-xt71000n, Op-xt71000n Firmware 2025-04-25 9.8 Critical
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that leads to command execution.
CVE-2020-23583 1 Optilinknetwork 2 Op-xt71000n, Op-xt71000n Firmware 2025-04-25 9.8 Critical
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.
CVE-2023-49034 1 Projeqtor 1 Projeqtor 2025-04-25 6.1 Medium
Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thecheckvalidHtmlText function in the ack.php and security.php files.
CVE-2023-46967 1 Enhancesoft 1 Osticket 2025-04-25 6.1 Medium
Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges via a crafted support ticket.
CVE-2022-3516 1 Librenms 1 Librenms 2025-04-25 6.1 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
CVE-2022-38114 1 Solarwinds 1 Security Event Manager 2025-04-25 6.1 Medium
This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.
CVE-2022-45887 3 Linux, Netapp, Redhat 14 Linux Kernel, H300s, H300s Firmware and 11 more 2025-04-25 4.7 Medium
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_detach call.
CVE-2022-45280 1 Eyoucms 1 Eyoucms 2025-04-25 5.4 Medium
A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2022-45221 1 Web-based Student Clearance System Project 1 Web-based Student Clearance System 2025-04-25 4.8 Medium
Web-Based Student Clearance System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in changepassword.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtnew_password parameter.
CVE-2022-45214 1 Sanitization Management System Project 1 Sanitization Management System 2025-04-25 6.1 Medium
A cross-site scripting (XSS) vulnerability in Sanitization Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter at /php-sms/classes/Login.php.
CVE-2022-45151 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-04-25 5.4 Medium
The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
CVE-2022-45150 2 Fedoraproject, Moodle 2 Fedora, Moodle 2025-04-25 6.1 Medium
A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in context of vulnerable website. This vulnerability may allow an attacker to perform cross-site scripting (XSS) attacks to gain access potentially sensitive information and modification of web pages.
CVE-2022-44789 3 Artifex, Debian, Fedoraproject 3 Mujs, Debian Linux, Fedora 2025-04-25 8.8 High
A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.