Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (14037 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-48093 1 Seacms 1 Seacms 2025-03-27 7.2 High
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
CVE-2022-47717 1 Lastyard 1 Last Yard 2025-03-27 7.5 High
Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
CVE-2024-27913 1 Frrouting 1 Frrouting 2025-03-26 6.2 Medium
ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field.
CVE-2024-40552 1 Publiccms 1 Publiccms 2025-03-26 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.
CVE-2023-22281 1 F5 1 Big-ip Advanced Firewall Manager 2025-03-26 7.5 High
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destination NAT rule is configured on a FastL4 virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-2623 1 Westboy 1 Cicadascms 2025-03-26 3.5 Low
A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2021-36424 1 Phpwcms 1 Phpwcms 2025-03-26 9.8 Critical
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
CVE-2024-9880 2025-03-26 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2021-36546 1 Kitesky 1 Kitecms 2025-03-26 7.5 High
Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.
CVE-2024-40544 1 Publiccms 1 Publiccms 2025-03-26 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.
CVE-2025-2691 1 Nossrf Project 1 Nossrf 2025-03-26 8.2 High
Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
CVE-2024-25413 2 Firebear Studio, Firebearstudio 2 Improved Import And Export, Improved Import \& Export 2025-03-26 9.1 Critical
A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file.
CVE-2023-24576 1 Dell 1 Emc Networker 2025-03-25 7.5 High
EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used.
CVE-2024-29202 1 Fit2cloud 1 Jumpserver 2025-03-25 10 Critical
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVE-2024-29201 1 Fit2cloud 1 Jumpserver 2025-03-25 10 Critical
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVE-2023-43651 2 Fit2cloud, Jumpserver 2 Jumpserver, Jumpserver 2025-03-25 8.6 High
JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remote code execution. This vulnerability may further be leveraged to gain root privileges on the system. Through the WEB CLI interface provided by the koko component, a user logs into the authorized mongoDB database and exploits the MongoDB session to execute arbitrary commands. This vulnerability has been addressed in versions 2.28.20 and 3.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-0671 1 Froxlor 1 Froxlor 2025-03-25 8.8 High
Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2023-23477 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, I and 5 more 2025-03-25 8.1 High
IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects. IBM X-Force ID: 245513.
CVE-2024-33442 1 Flusity 1 Flusity 2025-03-25 4.3 Medium
An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_post.php component.
CVE-2023-24333 1 Tenda 2 Ac21, Ac21 Firmware 2025-03-25 8.8 High
A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi.