Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (84582 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-36787 1 In2code 1 Femanager 2024-11-21 5.4 Medium
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
CVE-2021-36785 1 Miniorange 1 Saml 2024-11-21 5.4 Medium
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.
CVE-2021-36772 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 6.1 Medium
Zoho ManageEngine ADManager Plus before 7110 allows stored XSS.
CVE-2021-36771 1 Zohocorp 1 Manageengine Admanager Plus 2024-11-21 6.1 Medium
Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
CVE-2021-36760 1 Wso2 4 Api Manager, Identity Server, Identity Server As Key Manager and 1 more 2024-11-21 6.1 Medium
In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the callback parameter modifying the URL that precedes the callback parameter. Once the username or password reset procedure is completed, the JavaScript code will be executed. (recoverpassword.do also has an open redirect issue for a similar reason.)
CVE-2021-36755 1 Cgm-remote-monitor Project 1 Cgm-remote-monitor 2024-11-21 6.1 Medium
Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.
CVE-2021-36747 1 Blackboard 1 Blackboard Learn 2024-11-21 5.4 Medium
Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.
CVE-2021-36746 1 Blackboard 1 Blackboard Learn 2024-11-21 5.4 Medium
Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.
CVE-2021-36738 1 Apache 1 Pluto 2024-11-21 6.1 Medium
The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact
CVE-2021-36737 1 Apache 1 Pluto 2024-11-21 6.1 Medium
The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact
CVE-2021-36720 1 Pineapp 1 Mail Secure 2024-11-21 6.1 Medium
PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=<script>alert(1)</script> and stealing cookies .
CVE-2021-36707 1 Prolink 2 Prc2402m, Prc2402m Firmware 2024-11-21 9.8 Critical
In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a trivial command injection where the value of the led_cmd parameter is passed directly to do_system.
CVE-2021-36706 1 Prolink 2 Prc2402m, Prc2402m Firmware 2024-11-21 9.8 Critical
In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system.
CVE-2021-36705 1 Prolink 2 Prc2402m, Prc2402m Firmware 2024-11-21 9.8 Critical
In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069_local_port parameter is passed directly to system.
CVE-2021-36703 1 Htmly 1 Htmly 2024-11-21 6.1 Medium
The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.
CVE-2021-36702 1 Htmly 1 Htmly 2024-11-21 6.1 Medium
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.
CVE-2021-36698 1 Artica 1 Pandora Fms 2024-11-21 5.4 Medium
Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.
CVE-2021-36697 1 Artica 1 Pandora Fms 2024-11-21 6.7 Medium
With an admin account, the .htaccess file in Artica Pandora FMS <=755 can be overwritten with the File Manager component. The new .htaccess file contains a Rewrite Rule with a type definition. A normal PHP file can be uploaded with this new "file type" and the code can be executed with an HTTP request.
CVE-2021-36696 1 Deskpro 1 Deskpro 2024-11-21 5.4 Medium
Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation.
CVE-2021-36695 1 Deskpro 1 Deskpro 2024-11-21 5.4 Medium
Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in the download file feature on a manager profile due to lack of input validation.