Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8001 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-19858 1 Plutinosoft 1 Platinum 2024-11-21 7.5 High
Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy.
CVE-2020-19547 1 Popojicms 1 Popojicms 2024-11-21 6.5 Medium
Directory Traversal vulnerability exists in PopojiCMS 2.0.1 via the id parameter in admin.php.
CVE-2020-19360 1 Fhem 1 Fhem 2024-11-21 7.5 High
Local file inclusion in FHEM 6.0 allows in fhem/FileLog_logWrapper file parameter can allow an attacker to include a file, which can lead to sensitive information disclosure.
CVE-2020-19305 1 Metinfo 1 Metinfo 2024-11-21 9.8 Critical
An issue in /app/system/column/admin/index.class.php of Metinfo v7.0.0 causes the indeximg parameter to be deleted when the column is deleted, allowing attackers to escalate privileges.
CVE-2020-19304 1 Metinfo 1 Metinfo 2024-11-21 7.5 High
An issue in /admin/index.php?n=system&c=filept&a=doGetFileList of Metinfo v7.0.0 allows attackers to perform a directory traversal and access sensitive information.
CVE-2020-19154 1 Jflyfox 1 Jfinal Cms 2024-11-21 6.5 Medium
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'FileManager.editFile()' function in the component 'modules/filemanager/FileManagerController.java'.
CVE-2020-19150 1 Jflyfox 1 Jfinal Cms 2024-11-21 8.1 High
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information or cause a denial of service via the 'FileManager.delete()' function in the component 'modules/filemanager/FileManagerController.java'.
CVE-2020-19147 1 Jflyfox 1 Jfinal Cms 2024-11-21 6.5 Medium
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive infromation via the 'getFolder()' function in the component '/modules/filemanager/FileManager.java'.
CVE-2020-19146 1 Jflyfox 1 Jfinal Cms 2024-11-21 6.5 Medium
Improper Access Control in Jfinal CMS v4.7.1 and earlier allows remote attackers to obtain sensitive information via the 'TemplatePath' parameter in the component 'jfinal_cms/admin/folder/list'.
CVE-2020-18878 1 Skycaiji 1 Skycaiji 2024-11-21 5.3 Medium
Directory Traversal in Skycaiji v1.3 allows remote attackers to obtain sensitive information via the component 'index.php?m=admin&c=Tool&a=log&file=D%3A%5CphpStudy%5CWWW%5Cindex.php'.
CVE-2020-18665 1 Webport 1 Web Port 2024-11-21 5.3 Medium
Directory Traversal vulnerability in WebPort <=1.19.1 in tags of system settings.
CVE-2020-18438 1 Phpok 1 Phpok 2024-11-21 7.5 High
Directory traversal vulnerability in qinggan phpok 5.1, allows attackers to disclose sensitive information, via the title parameter to admin.php.
CVE-2020-18191 1 Get-simple 1 Getsimplecms 2024-11-21 9.1 Critical
GetSimpleCMS-3.3.15 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /GetSimpleCMS-3.3.15/admin/log.php
CVE-2020-18190 1 Bludit 1 Bludit 2024-11-21 9.1 Critical
Bludit v3.8.1 is affected by directory traversal. Remote attackers are able to delete arbitrary files via /admin/ajax/upload-profile-picture.
CVE-2020-18178 1 Hongcms Project 1 Hongcms 2024-11-21 9.8 Critical
Path Traversal in HongCMS v4.0.0 allows remote attackers to view, edit, and delete arbitrary files via a crafted POST request to the component "/hcms/admin/index.php/language/ajax."
CVE-2020-18127 1 Indexhibit 1 Indexhibit 2024-11-21 6.5 Medium
An issue in the /config/config.php component of Indexhibit 2.1.5 allows attackers to arbitrarily view files.
CVE-2020-18070 1 Idreamsoft 1 Icms 2024-11-21 9.1 Critical
Path Traversal in iCMS v7.0.13 allows remote attackers to delete folders by injecting commands into a crafted HTTP request to the "do_del()" method of the component "database.admincp.php".
CVE-2020-17564 1 Feifeicms 1 Feifeicms 2024-11-21 9.1 Critical
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.php" component.
CVE-2020-17563 1 Feifeicms 1 Feifeicms 2024-11-21 9.1 Critical
Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&id=".
CVE-2020-17389 1 Marvell 1 Qconvergeconsole 2024-11-21 8.8 High
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the decryptFile method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10502.