Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15562 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-24525 2 Epoint, Epointwebbuilder 2 Epointwebbuilder, Epointwebbuilder 2025-03-27 9.8 Critical
An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid parameter of the URL.
CVE-2024-55057 1 Phpgurukul 1 Online Birth Certificate System 2025-03-27 5.4 Medium
Phpgurukul Online Birth Certificate System 1.0 suffers from insufficient password requirements which can lead to unauthorized access to user accounts.
CVE-2022-27537 1 Hp 654 Dragonfly Folio G3 2-in-1, Dragonfly Folio G3 2-in-1 Firmware, Elite Dragonfly and 651 more 2025-03-27 7.8 High
Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities.
CVE-2023-23128 1 Connectwise 1 Connectwise 2025-03-27 6.1 Medium
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allow-Origin wildcarding to support product functionality, and that there is no risk from this behavior. The vulnerability report is thus not valid.
CVE-2022-4254 2 Fedoraproject, Redhat 16 Sssd, Enterprise Linux, Enterprise Linux Desktop and 13 more 2025-03-27 8.8 High
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVE-2022-48093 1 Seacms 1 Seacms 2025-03-27 7.2 High
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
CVE-2022-47717 1 Lastyard 1 Last Yard 2025-03-27 7.5 High
Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
CVE-2024-27913 1 Frrouting 1 Frrouting 2025-03-26 6.2 Medium
ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OSPF LSA packet, because of an attempted access to a missing attribute field.
CVE-2024-40552 1 Publiccms 1 Publiccms 2025-03-26 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a remote commande execution (RCE) vulnerability via the cmdarray parameter at /site/ScriptComponent.java.
CVE-2023-22281 1 F5 1 Big-ip Advanced Firewall Manager 2025-03-26 7.5 High
On versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8, 14.1.x before 14.1.5.3, and all versions of 13.1.x, when a BIG-IP AFM NAT policy with a destination NAT rule is configured on a FastL4 virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2025-2623 1 Westboy 1 Cicadascms 2025-03-26 3.5 Low
A vulnerability was found in westboy CicadasCMS 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /system/cms/content/save. The manipulation of the argument title/content/laiyuan leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2021-36424 1 Phpwcms 1 Phpwcms 2025-03-26 9.8 Critical
An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
CVE-2024-9880 2025-03-26 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2021-36546 1 Kitesky 1 Kitecms 2025-03-26 7.5 High
Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.
CVE-2024-40544 1 Publiccms 1 Publiccms 2025-03-26 8.8 High
PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery (SSRF) via the component /admin/#maintenance_sysTask/edit.
CVE-2025-2691 1 Nossrf Project 1 Nossrf 2025-03-26 8.2 High
Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname that resolves to a local or reserved IP address space and bypass the SSRF protection mechanism.
CVE-2024-25413 2 Firebear Studio, Firebearstudio 2 Improved Import And Export, Improved Import \& Export 2025-03-26 9.1 Critical
A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file.
CVE-2023-24576 1 Dell 1 Emc Networker 2025-03-25 7.5 High
EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution service (nsrexecd) irrespective of any auth used.
CVE-2024-29202 1 Fit2cloud 1 Jumpserver 2025-03-25 10 Critical
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerability in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.
CVE-2024-29201 1 Fit2cloud 1 Jumpserver 2025-03-25 10 Critical
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpServer's Ansible to execute arbitrary code within the Celery container. Since the Celery container runs with root privileges and has database access, attackers could steal sensitive information from all hosts or manipulate the database. This vulnerability is fixed in v3.10.7.