Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (326435 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-32813 1 Apple 6 Ipados, Iphone Os, Mac Os X and 3 more 2025-05-29 7.8 High
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5, macOS Big Sur 11.6.8, Security Update 2022-005 Catalina, iOS 15.6 and iPadOS 15.6, tvOS 15.6, watchOS 8.7. An app with root privileges may be able to execute arbitrary code with kernel privileges.
CVE-2022-23766 2 Bigfile, Microsoft 2 Bigfileagent, Windows 2025-05-29 7.8 High
An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website.
CVE-2024-4483 1 Wp-webhooks 1 Email Encoder 2025-05-29 5.4 Medium
The Email Encoder WordPress plugin before 2.2.2 does not escape the WP_Email_Encoder_Bundle_options[protection_text] parameter before outputting it back in an attribute in an admin page, leading to a Stored Cross-Site Scripting
CVE-2024-6362 1 Dotcamp 1 Ultimate Blocks 2025-05-29 4.6 Medium
The Ultimate Blocks WordPress plugin before 3.2.0 does not validate and escape some of its post-grid block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2024-6223 2 Yasir, Yasirwazir 2 Send Email Only On Reply To My Comment, Send Email Only On Reply To My Comment 2025-05-29 6.1 Medium
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-6224 2 Elance360, Yasirwazir 2 Send-email-only-on-reply-to-my-comment, Send Email Only On Reply To My Comment 2025-05-29 5.9 Medium
The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack
CVE-2024-1747 2 Vanquish, Woocommerce 2 Woocommerce Customers Manager, Woocommerce Customers Manager 2025-05-29 6.5 Medium
The WooCommerce Customers Manager WordPress plugin before 30.2 does not have authorisation and CSRF in various AJAX actions, allowing any authenticated users, such as subscriber, to call them and update/delete/create customer metadata, also leading to Stored Cross-Site Scripting due to the lack of escaping of said metadata values.
CVE-2024-2843 2 Vanquish, Woocommerce 2 Woocommerce Customers Manager, Woocommerce Customers Manager 2025-05-29 6.5 Medium
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some places, which could allow attackers to make logged in admin users delete users via CSRF attacks
CVE-2024-3983 2 Vanquish, Woocommerce 2 Woocommerce Customers Manager, Woocommerce Customers Manager 2025-05-29 8.1 High
The WooCommerce Customers Manager WordPress plugin before 30.1 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting customers via CSRF attacks
CVE-2024-46328 1 Vonets 2 Vap11g-300, Vap11g-300 Firmware 2025-05-29 8 High
VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain hardcoded credentials for several different privileged accounts, including root.
CVE-2024-46329 1 Vonets 2 Vap11g-300, Vap11g-300 Firmware 2025-05-29 8 High
VONETS VAP11G-300 v3.3.23.6.9 was discovered to contain a command injection vulnerability via the SystemCommand object.
CVE-2023-47189 1 Wpmudev 1 Defender 2025-05-29 5.3 Medium
Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.
CVE-2024-32792 1 Incsub 1 Hummingbird 2025-05-29 4.3 Medium
Missing Authorization vulnerability in WPMU DEV Hummingbird.This issue affects Hummingbird: from n/a through 3.7.3.
CVE-2023-37226 1 Loftware 1 Spectrum 2025-05-29 9.8 Critical
Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
CVE-2023-37227 1 Loftware 1 Spectrum 2025-05-29 9.8 Critical
Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
CVE-2023-37231 1 Loftware 1 Spectrum 2025-05-29 9.8 Critical
Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.
CVE-2023-43953 1 Sscms 1 Sscms 2025-05-29 5.4 Medium
SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
CVE-2024-51360 1 Phpgurukul 1 Hospital Management System 2025-05-29 9.8 Critical
An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file
CVE-2024-51108 1 Anujk305 1 Medical Card Generation System 2025-05-29 5.4 Medium
Multiple stored cross-site scripting (XSS) vulnerabilities in the component /admin/card-bwdates-report.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fromdate and todate parameters.
CVE-2024-51107 1 Anujk305 1 Medical Card Generation System 2025-05-29 4.8 Medium
Multiple stored cross-site scripting (XSS) vulnerabilities in the component /mcgs/admin/contactus.php of PHPGURUKUL Medical Card Generation System using PHP and MySQL v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the pagetitle, pagedes, and email parameters.