Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (86695 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-36884 1 Backupbliss 1 Backup Migration 2025-03-28 4.8 Medium
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability discovered in WordPress Backup Migration plugin <= 1.1.5 versions.
CVE-2024-29469 2 Oneblog Project, Zhyd 2 Oneblog, Oneblog 2025-03-28 6.1 Medium
A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category List parameter under the Lab module.
CVE-2021-36843 1 Acurax 1 Floating Social Media Icon 2025-03-28 4.8 Medium
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
CVE-2021-36919 1 Getawesomesupport 1 Awesome Support 2025-03-28 6.1 Medium
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
CVE-2021-36911 1 Comment Engine Pro Project 1 Comment Engine Pro 2025-03-28 4.8 Medium
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
CVE-2024-54181 2 Ibm, Linux 2 Websphere Automation, Linux Kernel 2025-03-28 7.2 High
IBM WebSphere Automation 1.7.5 could allow a remote privileged user, who has authorized access to the swagger UI, to execute arbitrary code. Using specially crafted input, the user could exploit this vulnerability to execute arbitrary code on the system.
CVE-2024-55100 1 Phpgurukul 1 Online Nurse Hiring System 2025-03-28 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fullname parameter.
CVE-2024-12151 1 Devolutions 1 Devolutions Server 2025-03-28 5 Medium
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVE-2024-12149 1 Devolutions 1 Remote Desktop Manager 2025-03-28 8.1 High
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that request temporary permissions on an entry to obtain more privileges than requested.
CVE-2024-1588 1 Pressified 1 Sendpress 2025-03-28 6.8 Medium
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2021-36889 1 Tarteaucitron.js - Cookies Legislation \& Gdpr Project 1 Tarteaucitron.js - Cookies Legislation \& Gdpr 2025-03-28 3.4 Low
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
CVE-2021-36887 1 Tarteaucitron.js - Cookies Legislation \& Gdpr Project 1 Tarteaucitron.js - Cookies Legislation \& Gdpr 2025-03-28 6.1 Medium
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
CVE-2021-36885 1 Ciphercoin 1 Contact Form 7 Database Addon 2025-03-28 6.1 Medium
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
CVE-2023-24612 1 Pdfbook Project 1 Pdfbook 2025-03-28 9.8 Critical
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
CVE-2023-24065 1 Nosh Chartingsystem Project 1 Nosh Chartingsystem 2025-03-28 5.4 Medium
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.
CVE-2023-22333 1 Mubag 1 Easymail 2025-03-28 6.1 Medium
Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2022-48118 1 Jorani 1 Jorani 2025-03-28 6.1 Medium
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
CVE-2022-48108 1 Dlink 2 Dir 878, Dir 878 Firmware 2025-03-28 9.8 Critical
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVE-2022-48107 1 Dlink 2 Dir 878, Dir 878 Firmware 2025-03-28 9.8 Critical
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVE-2022-48072 1 Phicomm 2 K2, K2 Firmware 2025-03-28 7.8 High
Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.