Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (86694 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-48069 1 Totolink 2 A830r, A830r Firmware 2025-03-28 7.5 High
Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
CVE-2022-48067 1 Totolink 2 A830r, A830r Firmware 2025-03-28 5.5 Medium
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
CVE-2022-46087 1 Cloudschool Project 1 Cloudschool 2025-03-28 5.4 Medium
CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin users through notification received by the admin user.
CVE-2024-27625 1 Cmsmadesimple 1 Cms Made Simple 2025-03-28 4.8 Medium
CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.
CVE-2024-27622 1 Cmsmadesimple 1 Cms Made Simple 2025-03-28 7.2 High
A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. This vulnerability arises from inadequate sanitization of user-supplied input in the 'Code' section of the module. As a result, authenticated users with administrative privileges can inject and execute arbitrary PHP code.
CVE-2023-0566 1 Froxlor 1 Froxlor 2025-03-28 6.2 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
CVE-2023-0572 1 Froxlor 1 Froxlor 2025-03-28 5.3 Medium
Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-0549 1 Yetanotherforum 1 Yaf.net 2025-03-28 3.5 Low
A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.
CVE-2022-48176 1 Netgear 12 Mr60, Mr60 Firmware, Ms60 and 9 more 2025-03-28 7.8 High
Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authentication stack overflow.
CVE-2024-28562 1 Freeimage Project 1 Freeimage 2025-03-28 6.8 Medium
Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::copyIntoFrameBuffer() component when reading images in EXR format.
CVE-2023-49977 1 Oretnom23 1 Customer Support System 2025-03-28 5.4 Medium
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at /customer_support/index.php?page=new_customer.
CVE-2023-49976 1 Oretnom23 1 Customer Support System 2025-03-28 5.4 Medium
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at /customer_support/index.php?page=new_ticket.
CVE-2023-49974 2 Oretnom23, Sourcecodester 2 Customer Support System, Customer Support System 2025-03-28 6.1 Medium
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customer_support/index.php?page=customer_list.
CVE-2023-51281 2 Oretnom23, Sourcecodester 2 Customer Support System, Customer Support System 2025-03-28 5.4 Medium
Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname", "middlename", "contact" and address parameters.
CVE-2024-27743 2 Mayurik, Petroleum Management Software Application Project 2 Petrol Pump Management, Petroleum Management Software Application 2025-03-28 6.1 Medium
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the Address parameter in the add_invoices.php component.
CVE-2024-27744 1 Mayurik 1 Petrol Pump Management 2025-03-28 6.1 Medium
Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the image parameter in the profile.php component.
CVE-2025-0281 1 Lunary 1 Lunary 2025-03-28 5.4 Medium
A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An attacker can inject malicious JavaScript into the SAML IdP XML metadata, which is used to generate the SAML login redirect URL. This URL is then set as the value of `window.location.href` without proper validation or sanitization. This vulnerability allows the attacker to execute arbitrary JavaScript in the context of the user's browser, potentially leading to session hijacking, data theft, or other malicious actions. The issue is fixed in version 1.7.10.
CVE-2024-29419 1 Totolink 2 X2000r, X2000r Firmware 2025-03-27 5.4 Medium
There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B20231213.1013.
CVE-2024-28156 1 Jenkins 1 Build Monitor View 2025-03-27 5.4 Medium
Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views.
CVE-2024-24389 1 Xunruicms 1 Xunruicms 2025-03-27 6.1 Medium
A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Add Column Name parameter.