Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88144 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-44284 1 Dinstar 2 Dag2000-16o, Dag2000-16o Firmware 2025-04-25 5.4 Medium
Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44260 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
CVE-2022-44259 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
CVE-2022-44258 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
CVE-2022-44257 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
CVE-2022-44256 1 Totolink 2 Nr1800x, Nr1800x Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
CVE-2022-44255 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 9.8 Critical
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
CVE-2022-44254 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.
CVE-2022-44253 1 Totolink 2 Lr350, Lr350 Firmware 2025-04-25 8.8 High
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
CVE-2022-3834 1 Google Forms Project 1 Google Forms 2025-04-25 4.8 Medium
The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2022-34667 3 Linux, Microsoft, Nvidia 3 Linux Kernel, Windows, Cuda Toolkit 2025-04-25 4.4 Medium
NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote attacker could exploit this buffer overflow condition by persuading a local user to download a specially crafted corrupted file and execute cuobjdump against it locally, which may lead to a limited denial of service and some loss of data integrity for the local user.
CVE-2022-0137 1 Htmldoc Project 1 Htmldoc 2025-04-25 7.5 High
A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.
CVE-2022-45472 1 Caehealthcare 1 Learningspace Enterprise 2025-04-25 5.4 Medium
CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.
CVE-2022-45462 1 Apache 1 Dolphinscheduler 2025-04-25 9.8 Critical
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
CVE-2022-45040 1 Wbce 1 Wbce Cms 2025-04-25 5.4 Medium
A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name Section field.
CVE-2022-45038 1 Wbce 1 Wbce Cms 2025-04-25 5.4 Medium
A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field.
CVE-2022-45037 1 Wbce 1 Wbce Cms 2025-04-25 5.4 Medium
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
CVE-2022-45036 1 Wbce 1 Wbce Cms 2025-04-25 5.4 Medium
A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the No Results field.
CVE-2021-39343 1 Mpl-publisher 1 Mpl-publisher 2025-04-25 5.5 Medium
The MPL-Publisher WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the ~/libs/PublisherController.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.30.2. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
CVE-2022-43561 1 Splunk 2 Splunk, Splunk Cloud Platform 2025-04-25 6.4 Medium
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to persistent cross-site scripting (XSS). The vulnerability affects instances with Splunk Web enabled.