Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88119 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-45020 1 Rukovoditel 1 Rukovoditel 2025-04-24 8.8 High
Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted GET request.
CVE-2022-44950 1 Rukovoditel 1 Rukovoditel 2025-04-24 5.4 Medium
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVE-2022-44949 1 Rukovoditel 1 Rukovoditel 2025-04-24 5.4 Medium
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.
CVE-2022-44948 1 Rukovoditel 1 Rukovoditel 2025-04-24 5.4 Medium
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
CVE-2022-44947 1 Rukovoditel 1 Rukovoditel 2025-04-24 5.4 Medium
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".
CVE-2022-44946 1 Rukovoditel 1 Rukovoditel 2025-04-24 5.4 Medium
Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
CVE-2022-43706 1 Stackstorm 1 Stackstorm 2025-04-24 5.4 Medium
Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject arbitrary script or HTML that may be executed in Web UI for other logged in users.
CVE-2022-43556 1 Concretecms 1 Concrete Cms 2025-04-24 6.1 Medium
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output is not sanitized. The Concrete CMS security team has ranked this 4.2 with CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Thanks @_akbar_jafarli_ for reporting. Remediate by updating to Concrete CMS 8.5.10 and Concrete CMS 9.1.3.
CVE-2022-43500 1 Wordpress 1 Wordpress 2025-04-24 6.1 Medium
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
CVE-2022-43499 1 Ss-proj 1 Shirasagi 2025-04-24 5.4 Medium
Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
CVE-2022-43497 1 Wordpress 1 Wordpress 2025-04-24 6.1 Medium
Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer also provides new patched releases for all versions since 3.7.
CVE-2022-43487 1 Salonbookingsystem 1 Salon Booking System 2025-04-24 6.1 Medium
Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2022-39133 2 Google, Unisoc 14 Android, S8022, Sc7731e and 11 more 2025-04-24 5.5 Medium
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
CVE-2022-39132 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-24 5.5 Medium
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39129 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-24 5.5 Medium
In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2022-39106 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-24 5.5 Medium
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
CVE-2021-34181 1 Tomexam 1 Tomexam 2025-04-24 6.1 Medium
Cross Site Scripting (XSS) vulnerability in TomExam 3.0 via p_name parameter to list.thtml.
CVE-2022-46089 2 Oretnom23, Sourcecodester 2 Online Flight Booking Management System, Online Flight Booking Management System 2025-04-24 6.1 Medium
Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.
CVE-2025-3690 1 Phpgurukul 1 Men Salon Management System 2025-04-24 7.3 High
A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/edit-services.php. The manipulation of the argument cost leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-3684 1 Xianqi 1 Kindergarten Management System 2025-04-24 6.3 Medium
A vulnerability was found in Xianqi Kindergarten Management System 2.0 Bulid 20190808. It has been rated as critical. This issue affects some unknown processing of the file stu_list.php of the component Child Management. The manipulation of the argument sex leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.