Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15427 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-24327 1 Discourse 1 Discourse 2024-11-21 5.3 Medium
Server Side Request Forgery (SSRF) vulnerability exists in Discourse 2.3.2 and 2.6 via the email function. When writing an email in an editor, you can upload pictures of remote websites.
CVE-2020-24149 1 Secondline 1 Podcast Importer Secondline 2024-11-21 7.5 High
Server-side request forgery (SSRF) in the Podcast Importer SecondLine (podcast-importer-secondline) plugin 1.1.4 for WordPress via the podcast_feed parameter in a secondline_import_initialize action to the secondlinepodcastimport page.
CVE-2020-24148 1 Mooveagency 1 Import Xml And Rss Feeds 2024-11-21 9.1 Critical
Server-side request forgery (SSRF) in the Import XML and RSS Feeds (import-xml-feed) plugin 2.0.1 for WordPress via the data parameter in a moove_read_xml action.
CVE-2020-24147 1 Xylusthemes 1 Wp Smart Import 2024-11-21 9.1 Critical
Server-side request forgery (SSR) vulnerability in the WP Smart Import (wp-smart-import) plugin 1.0.0 for WordPress via the file field.
CVE-2020-24142 1 Ninjateam 1 Video Downloader For Tiktok 2024-11-21 9.8 Critical
Server-side request forgery in the Video Downloader for TikTok (aka downloader-tiktok) plugin 1.3 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the njt-tk-download-video parameter. It can help identify open ports, local network hosts and execute command on services
CVE-2020-24141 1 Wp-downloadmanager Project 1 Wp-downloadmanager 2024-11-21 5.3 Medium
Server-side request forgery in the WP-DownloadManager plugin 1.68.4 for WordPress lets an attacker send crafted requests from the back-end server of a vulnerable web application via the file_remote parameter to download-add.php. It can help identify open ports, local network hosts and execute command on services
CVE-2020-24140 1 Wcms 1 Wcms 2024-11-21 8.3 High
Server-side request forgery in Wcms 0.3.2 let an attacker send crafted requests from the back-end server of a vulnerable web application via the pagename parameter to wex/html.php. It can help identify open ports, local network hosts and execute command on local services.
CVE-2020-24139 1 Wcms 1 Wcms 2024-11-21 8.3 High
Server-side request forgery in Wcms 0.3.2 lets an attacker send crafted requests from the back-end server of a vulnerable web application via the path parameter to wex/cssjs.php. It can help identify open ports, local network hosts and execute command on local services.
CVE-2020-24063 1 Canto 1 Canto 2024-11-21 7.2 High
The Canto plugin 1.3.0 for WordPress allows includes/lib/download.php?subdomain= SSRF.
CVE-2020-23776 1 Winmail Project 1 Winmail 2024-11-21 7.5 High
A SSRF vulnerability exists in Winmail 6.5 in app.php in the key parameter when HTTPS is on. An attacker can use this vulnerability to cause the server to send a request to a specific URL. An attacker can modify the request header 'HOST' value to cause the server to send the request.
CVE-2020-23622 1 Cling Project 1 Cling 2024-11-21 7.5 High
An issue in the UPnP protocol in 4thline cling 2.0.0 through 2.1.2 allows remote attackers to cause a denial of service via an unchecked CALLBACK parameter in the request header
CVE-2020-23534 1 Masterlab 1 Masterlab 2024-11-21 9.8 Critical
A server-side request forgery (SSRF) vulnerability in Upgrade.php of gopeak masterlab 2.1.5, via the 'source' parameter.
CVE-2020-23219 1 Monstra 1 Monstra Cms 2024-11-21 8.8 High
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module.
CVE-2020-23079 1 Halo 1 Halo 2024-11-21 7.5 High
SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
CVE-2020-23037 1 Portable 1 Playable 2024-11-21 9.8 Critical
Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter, which allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.
CVE-2020-22937 1 Phome 1 Empirecms 2024-11-21 9.8 Critical
A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the install file.
CVE-2020-22612 1 Mybb 1 Mybb 2024-11-21 9.8 Critical
Installer RCE on settings file write in MyBB before 1.8.22.
CVE-2020-22201 1 Phpcms 1 Phpcms 2024-11-21 8.8 High
phpCMS 2008 sp4 allowas remote malicious users to execute arbitrary php commands via the pagesize parameter to yp/product.php.
CVE-2020-22120 1 Txjia 1 Imcat 2024-11-21 8.8 High
A remote code execution (RCE) vulnerability in /root/run/adm.php?admin-ediy&part=exdiy of imcat v5.1 allows authenticated attackers to execute arbitrary code.
CVE-2020-22002 1 Inim 12 Smartliving 10100l, Smartliving 10100l Firmware, Smartliving 10100lg3 and 9 more 2024-11-21 7.5 High
An Unauthenticated Server-Side Request Forgery (SSRF) vulnerability exists in Inim Electronics Smartliving SmartLAN/G/SI <=6.x within the GetImage functionality. The application parses user supplied data in the GET parameter 'host' to construct an image request to the service through onvif.cgi. Since no validation is carried out on the parameter, an attacker can specify an external domain and force the application to make an HTTP request to an arbitrary destination host.