Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328065 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-46242 1 Kibokolabs 1 Watu Quiz 2025-04-29 7.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz allows SQL Injection. This issue affects Watu Quiz: from n/a through 3.4.3.
CVE-2025-46243 1 Sktthemes 1 Recover Abandoned Cart For Woocommerce 2025-04-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce allows Cross Site Request Forgery. This issue affects Recover abandoned cart for WooCommerce: from n/a through 2.2.
CVE-2022-40663 1 Nikon 1 Nis-elements Viewer 2025-04-29 7.8 High
This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15697.
CVE-2025-46244 1 Multidots 1 Advanced Linked Variations For Woocommerce 2025-04-29 5.3 Medium
Missing Authorization vulnerability in Dotstore Advanced Linked Variations for Woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Advanced Linked Variations for Woocommerce: from n/a through 1.0.3.
CVE-2025-46245 1 Cminds 1 Cm Ad Changer 2025-04-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Ad Changer allows Cross Site Request Forgery. This issue affects CM Ad Changer: from n/a through 2.0.5.
CVE-2025-46246 1 Cminds 1 Cm Answers 2025-04-29 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM Answers allows Cross Site Request Forgery. This issue affects CM Answers: from n/a through 3.3.3.
CVE-2025-46247 1 Codepeople 1 Appointment Booking Calendar 2025-04-29 5.3 Medium
Missing Authorization vulnerability in codepeople Appointment Booking Calendar allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Appointment Booking Calendar: from n/a through 1.3.92.
CVE-2024-55279 1 Uguu 1 Uguu 2025-04-29 6 Medium
Uguu through 1.8.9 allows Cross Site Scripting (XSS) via JavaScript in XML files.
CVE-2022-3895 1 Hallowelt 2 Bluespice, Common User Interface 2025-04-29 4 Medium
Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS).
CVE-2024-11503 1 Shapedplugin 1 Wp Tabs 2025-04-29 6.1 Medium
The WP Tabs WordPress plugin before 2.2.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-12109 1 Acowebs 1 Product Labels For Woocommerce \(sale Badges\) 2025-04-29 4.1 Medium
The Product Labels For Woocommerce (Sale Badges) WordPress plugin before 1.5.9 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVE-2024-12769 1 Simple Banner Project 1 Simple Banner 2025-04-29 3.5 Low
The Simple Banner WordPress plugin before 3.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2024-13863 1 Wppluginbox 1 Stylish Google Sheet Reader 2025-04-29 7.1 High
The Stylish Google Sheet Reader 4.0 WordPress plugin before 4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-9770 1 Plechevandrey 1 Wp-recall 2025-04-29 4.7 Medium
The WP-Recall WordPress plugin before 16.26.12 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVE-2022-4116 2 Quarkus, Redhat 3 Quarkus, Build Of Quarkus, Quarkus 2025-04-29 9.8 Critical
A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.
CVE-2022-45536 1 Aerocms Project 1 Aerocms 2025-04-29 4.9 Medium
AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php. This vulnerability allows attackers to access database information.
CVE-2022-44158 1 Tenda 2 Ac21, Ac21 Firmware 2025-04-29 7.5 High
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
CVE-2022-44156 1 Tenda 2 Ac15, Ac15 Firmware 2025-04-29 7.5 High
Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
CVE-2022-3690 1 Code-atlantic 1 Popup Maker 2025-04-29 5.5 Medium
The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks, which could be used against admins
CVE-2022-3688 1 2code 1 Wpqa Builder 2025-04-29 8.8 High
The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users perform such actions via CSRF attacks