Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (84802 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-23988 1 Westguardsolutions 1 Ws Form 2024-11-21 6.1 Medium
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
CVE-2022-23987 1 Westguardsolutions 1 Ws Form 2024-11-21 4.8 Medium
The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-23973 1 Asus 2 Rt-ax56u, Rt-ax56u Firmware 2024-11-21 8.8 High
ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service.
CVE-2022-23942 1 Apache 1 Doris 2024-11-21 7.5 High
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
CVE-2022-23935 1 Exiftool Project 1 Exiftool 2024-11-21 7.8 High
lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\|$/ check, leading to command injection.
CVE-2022-23916 1 Appleple 1 A-blog Cms 2024-11-21 6.1 Medium
Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-24374.
CVE-2022-23912 1 Accesspressthemes 1 Ap Custom Testimonial 2024-11-21 6.1 Medium
The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
CVE-2022-23907 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 6.1 Medium
CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
CVE-2022-23903 1 Pearadmin 1 Pear Admin Think 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent.
CVE-2022-23901 1 Re2c 1 Re2c 2024-11-21 9.8 Critical
A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
CVE-2022-23900 1 Wavlink 2 Wl-wn531p3, Wl-wn531p3 Firmware 2024-11-21 9.8 Critical
A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.
CVE-2022-23896 1 Admidio 1 Admidio 2024-11-21 5.4 Medium
Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
CVE-2022-23872 1 Emlog 1 Emlog 2024-11-21 4.8 Medium
Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info.
CVE-2022-23871 1 Gibbonedu 1 Gibbon 2024-11-21 5.4 Medium
Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters.
CVE-2022-23869 1 Ruoyi 1 Ruoyi 2024-11-21 6.5 Medium
In RuoYi v4.7.2 through the WebUI, user test1 does not have permission to reset the password of user test3, but the password of user test3 can be reset through the /system/user/resetPwd request.
CVE-2022-23850 1 Epub2txt Project 1 Epub2txt 2024-11-21 7.8 High
xhtml_translate_entity in xhtml.c in epub2txt (aka epub2txt2) through 2.02 allows a stack-based buffer overflow via a crafted EPUB document.
CVE-2022-23837 3 Contribsys, Debian, Redhat 3 Sidekiq, Debian Linux, Satellite 2024-11-21 7.5 High
In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no limit on the number of days when requesting stats for the graph. This overloads the system, affecting the Web UI, and makes it unavailable to users.
CVE-2022-23745 1 Checkpoint 1 Capsule Workspace 2024-11-21 7.5 High
A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information.
CVE-2022-23743 1 Checkpoint 1 Zonealarm 2024-11-21 7.8 High
Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory allow a local attacker the ability to execute an arbitrary file write, leading to execution of code as local system, in ZoneAlarm versions before v15.8.211.192119
CVE-2022-23733 1 Github 1 Enterprise Server 2024-11-21 5.4 Medium
A stored XSS vulnerability was identified in GitHub Enterprise Server that allowed the injection of arbitrary attributes. This injection was blocked by Github's Content Security Policy (CSP). This vulnerability affected all versions of GitHub Enterprise Server prior to 3.6 and was fixed in versions 3.3.11, 3.4.6 and 3.5.3. This vulnerability was reported via the GitHub Bug Bounty program.