Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (86720 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-21191 1 Global-modules-path Project 1 Global-modules-path 2025-04-04 7.4 High
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
CVE-2023-27084 1 Iteachyou 1 Dreamer Cms 2025-04-04 5.3 Medium
Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentController parameter.
CVE-2023-43857 1 Iteachyou 1 Dreamer Cms 2025-04-04 5.4 Medium
Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.
CVE-2023-1746 1 Iteachyou 1 Dreamer Cms 2025-04-04 3.5 Low
A vulnerability, which was classified as problematic, was found in Dreamer CMS up to 3.5.0. Affected is an unknown function of the component File Upload Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-224634 is the identifier assigned to this vulnerability.
CVE-2023-0287 1 Favorites-web Project 1 Favorites-web 2025-04-04 3.5 Low
A vulnerability was found in ityouknow favorites-web. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Comment Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-218294 is the identifier assigned to this vulnerability.
CVE-2024-34218 1 Totolink 2 Cp450, Cp450 Firmware 2025-04-04 3.8 Low
TOTOLINK outdoor CPE CP450 v4.1.0cu.747_B20191224 was discovered to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter.
CVE-2024-34219 1 Totolink 2 Cp450, Cp450 Firmware 2025-04-04 8.6 High
TOTOLINK CP450 V4.1.0cu.747_B20191224 was discovered to contain a vulnerability in the SetTelnetCfg function, which allows attackers to log in through telnet.
CVE-2024-34921 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 8.8 High
TOTOLINK X5000R v9.1.0cu.2350_B20230313 was discovered to contain a command injection via the disconnectVPN function.
CVE-2024-5700 2 Mozilla, Redhat 7 Firefox, Thunderbird, Enterprise Linux and 4 more 2025-04-04 7.0 High
Memory safety bugs present in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 127, Firefox ESR < 115.12, and Thunderbird < 115.12.
CVE-2024-53333 1 Totolink 2 Ex200, Ex200 Firmware 2025-04-04 6.3 Medium
TOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allows an attacker to execute arbitrary commands via the "ussd" parameter.
CVE-2024-9400 2 Mozilla, Redhat 9 Firefox, Firefox Esr, Thunderbird and 6 more 2025-04-04 8.8 High
A potential memory corruption vulnerability could be triggered if an attacker had the ability to trigger an OOM at a specific moment during JIT compilation. This vulnerability affects Firefox < 131, Firefox ESR < 128.3, Thunderbird < 128.3, and Thunderbird < 131.
CVE-2024-42740 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6.8 Medium
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42736 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 7.8 High
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-11004 1 Ivanti 2 Connect Secure, Policy Secure 2025-04-04 6.1 Medium
Reflected XSS in Ivanti Connect Secure before version 22.7R2.1 and Ivanti Policy Secure before version 22.7R1.1 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.
CVE-2024-32349 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6 Medium
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary.
CVE-2024-32351 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 8.8 High
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the "mru" parameter in the "cstecgi.cgi" binary.
CVE-2024-32353 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 9.8 Critical
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'port' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.
CVE-2024-32354 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6 Medium
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'timeout' parameter in the setSSServer function at /cgi-bin/cstecgi.cgi.
CVE-2024-32355 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 8 High
TOTOLINK X5000R V9.1.0cu.2350_B20230313 was discovered to contain a command injection vulnerability via the 'password' parameter in the setSSServer function.
CVE-2024-34954 1 Code-projects 1 Budget Management 2025-04-04 6.1 Medium
Code-projects Budget Management 1.0 is vulnerable to Cross Site Scripting (XSS) via the budget parameter.