Search

Expected end of text, found '.' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (308029 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-0280 1 Hcltech 1 Compass 2025-09-03 7.5 High
A security vulnerability in HCL Compass can allow attacker to gain unauthorized database access.
CVE-2025-53693 1 Sitecore 2 Experience Manager, Experience Platform 2025-09-03 9.8 Critical
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM): from 9.0 through 9.3, from 10.0 through 10.4; Experience Platform (XP): from 9.0 through 9.3, from 10.0 through 10.4.
CVE-2025-53694 1 Sitecore 2 Experience Manager, Experience Platform 2025-09-03 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.
CVE-2025-58643 2 Enituretechnology, Wordpress 2 Ltl Freight Quotes, Wordpress 2025-09-03 7.2 High
Deserialization of Untrusted Data vulnerability in enituretechnology LTL Freight Quotes – Daylight Edition allows Object Injection. This issue affects LTL Freight Quotes – Daylight Edition: from n/a through 2.2.7.
CVE-2025-58621 2 Amuse Labs, Wordpress 2 Puzzleme Plugin, Wordpress 2025-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress allows Stored XSS. This issue affects PuzzleMe for WordPress: from n/a through 1.2.0.
CVE-2025-9920 1 Campcodes 1 Online Recruitment Management System 2025-09-03 4.7 Medium
A security flaw has been discovered in Campcodes Recruitment Management System 1.0. This impacts the function include of the file /admin/index.php. The manipulation of the argument page results in file inclusion. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVE-2025-58596 2 Mailoptin, Wordpress 2 Mailoptin, Wordpress 2025-09-03 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin allows Stored XSS. This issue affects MailOptin: from n/a through 1.2.75.0.
CVE-2025-58614 2 Tooltipy, Wordpress 2 Tooltipy, Wordpress 2025-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy allows Stored XSS. This issue affects Tooltipy: from n/a through 5.5.6.
CVE-2025-58622 2 Wordpress, Yydevelopment 2 Wordpress, Mobile Contact Line Plugin 2025-09-03 4.3 Medium
Missing Authorization vulnerability in yydevelopment Mobile Contact Line allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mobile Contact Line: from n/a through 2.4.0.
CVE-2025-58626 2 Rumbletalk, Wordpress 2 Live Group Chat Plugin, Wordpress 2025-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RumbleTalk RumbleTalk Live Group Chat allows Stored XSS. This issue affects RumbleTalk Live Group Chat: from n/a through 6.3.5.
CVE-2025-58594 2 Brizy, Wordpress 2 Brizy, Wordpress 2025-09-03 4.3 Medium
Missing Authorization vulnerability in themefusecom Brizy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Brizy: from n/a through 2.7.12.
CVE-2025-57149 1 Phpgurukul 1 Complaint Management System 2025-09-03 6.5 Medium
phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter.
CVE-2025-57052 1 Cjson Project 1 Cjson 2025-09-03 9.8 Critical
cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.
CVE-2025-58632 2 Dadevarzan, Wordpress 2 Wordpress Common Plugin, Wordpress 2025-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dadevarzan Dadevarzan WordPress Common allows Stored XSS. This issue affects Dadevarzan WordPress Common: from n/a through 2.2.2.
CVE-2025-57147 1 Phpgurukul 1 Complaint Management System 2025-09-03 7.5 High
A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.
CVE-2025-58598 3 Klarna, Woocommerce, Wordpress 3 Klarna For Woocommerce, Woocommerce, Wordpress 2025-09-03 6.6 Medium
Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects Klarna Order Management for WooCommerce: from n/a through 1.9.8.
CVE-2025-58623 1 Wordpress 1 Wordpress 2025-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite allows DOM-Based XSS. This issue affects Event Feed for Eventbrite: from n/a through 1.3.2.
CVE-2025-56498 1 Boa 1 Boa 2025-09-03 5.3 Medium
An OS command injection vulnerability exists in PLDT WiFi Router's Prolink PGN6401V Firmware 8.1.2 web management interface. The ping6.asp page submits user input to the /boaform/formPing6 endpoint via the pingAddr parameter, which is not properly sanitized. An authenticated attacker can exploit this flaw by injecting arbitrary system commands, which are executed by the underlying operating system with root privileges. The router uses the Boa web server (version 0.93.15) to handle the request. Successful exploitation can lead to full system compromise and unauthorized control of the network device.
CVE-2025-58631 2 Wordpress, Zeen101 2 Wordpress, Issuem Plugin 2025-09-03 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ZEEN101 IssueM allows DOM-Based XSS. This issue affects IssueM: from n/a through 2.9.0.
CVE-2025-55852 1 Tenda 1 Ac8 2025-09-03 7.5 High
Tenda AC8 v16.03.34.06 is vulnerable to Buffer Overflow in the formWifiBasicSet function via the parameter security or security_5g.