Search
Search Results (383356 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-50619 | 1 Cipplanner | 1 Cipace | 2026-02-13 | 8.8 High |
| Vulnerabilities in the My Account and User Management components in CIPPlanner CIPAce before 9.17 allows attackers to escalate their access levels. A low-privileged authenticated user can gain access to other people's accounts by tampering with the client's user id to change their account information. A low-privileged authenticated user can elevate his or her system privileges by modifying the information of a user role that is disabled in the client. | ||||
| CVE-2024-50617 | 1 Cipplanner | 1 Cipace | 2026-02-13 | 7.5 High |
| Vulnerabilities in the File Download and Get File handler components in CIPPlanner CIPAce before 9.17 allow attackers to download unauthorized files. An authenticated user can easily change the file id parameter or pass the physical file path in the URL query string to retrieve the files. (Retrieval is not intended without correct data access configured for documents.) | ||||
| CVE-2019-25348 | 1 Computrols | 1 Cbas-web | 2026-02-13 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2023-33498 | 1 Alistgo | 1 Alist | 2026-02-13 | 8.8 High |
| alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file. | ||||
| CVE-2025-63647 | 1 Owntone | 2 Owntone-server, Owntone Server | 2026-02-13 | 7.5 High |
| A NULL pointer dereference in the parse_meta function (src/httpd_daap.c) of owntone-server commit 334beb allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server. | ||||
| CVE-2025-24054 | 1 Microsoft | 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more | 2026-02-13 | 6.5 Medium |
| External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2022-45969 | 1 Alistgo | 1 Alist | 2026-02-13 | 9.8 Critical |
| Alist v3.4.0 is vulnerable to Directory Traversal, | ||||
| CVE-2024-47067 | 2 Alist Project, Alistgo | 2 Alist, Alist | 2026-02-13 | 6.1 Medium |
| AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0. | ||||
| CVE-2022-45968 | 1 Alistgo | 1 Alist | 2026-02-13 | 8.8 High |
| Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one). | ||||
| CVE-2022-45970 | 1 Alistgo | 1 Alist | 2026-02-13 | 5.4 Medium |
| Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board. | ||||
| CVE-2022-26533 | 1 Alistgo | 1 Alist | 2026-02-13 | 6.1 Medium |
| Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. | ||||
| CVE-2023-31726 | 1 Alistgo | 1 Alist | 2026-02-13 | 7.5 High |
| AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information. | ||||
| CVE-2025-68128 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-68127 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-68126 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-68125 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-68124 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-58184 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-58182 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-47915 | 2026-02-13 | N/A | ||
| reserved but not needed | ||||