Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15360 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2016-6565 1 Imagely 1 Nextgen Gallery 2024-11-21 N/A
The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request, which may allow an authenticated user to read arbitrary files from the server, or execute arbitrary code on the server in some circumstances (dependent on server configuration).
CVE-2016-6272 1 Epic 1 Mychart 2024-11-21 N/A
XPath injection vulnerability in Epic MyChart allows remote attackers to access contents of an XML document containing static display strings, such as field labels, via the topic parameter to help.asp. NOTE: this was originally reported as a SQL injection vulnerability, but this may be inaccurate.
CVE-2016-5402 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2024-11-21 N/A
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.
CVE-2016-4975 2 Apache, Redhat 3 Http Server, Enterprise Linux, Jboss Core Services 2024-11-21 N/A
Possible CRLF injection allowing HTTP response splitting attacks for sites which use mod_userdir. This issue was mitigated by changes made in 2.4.25 and 2.2.32 which prohibit CR or LF injection into the "Location" or other outbound header key or value. Fixed in Apache HTTP Server 2.4.25 (Affected 2.4.1-2.4.23). Fixed in Apache HTTP Server 2.2.32 (Affected 2.2.0-2.2.31).
CVE-2016-4397 1 Hp 1 Network Node Manager I 2024-11-21 N/A
A local code execution security vulnerability was identified in HP Network Node Manager i (NNMi) v10.00, v10.10 and v10.20 Software.
CVE-2016-4391 1 Hp 1 Arcsight Winc Connector 2024-11-21 N/A
A remote code execution security vulnerability has been identified in all versions of the HP ArcSight WINC Connector prior to v7.3.0.
CVE-2016-11064 1 Mattermost 1 Mattermost Desktop 2024-11-21 9.8 Critical
An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.
CVE-2016-10927 1 Neliosoftware 1 Nelio Ab Testing 2024-11-21 N/A
The nelio-ab-testing plugin before 4.5.11 for WordPress has SSRF in ajax/iesupport.php.
CVE-2016-10926 1 Neliosoftware 1 Nelio Ab Testing 2024-11-21 N/A
The nelio-ab-testing plugin before 4.5.9 for WordPress has SSRF in ajax/iesupport.php.
CVE-2016-10803 1 Cpanel 1 Cpanel 2024-11-21 N/A
cPanel before 57.9999.105 allows newline injection via LOC records (CPANEL-6923).
CVE-2016-10548 1 Reduce-css-calc Project 1 Reduce-css-calc 2024-11-21 N/A
Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.
CVE-2016-10546 1 Pouchdb 1 Pouchdb 2024-11-21 N/A
An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands.
CVE-2016-10541 1 Shell-quote Project 1 Shell-quote 2024-11-21 9.8 Critical
The npm module "shell-quote" 1.6.0 and earlier cannot correctly escape ">" and "<" operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.
CVE-2015-9298 1 Pixelite 1 Events Manager 2024-11-21 9.8 Critical
The events-manager plugin before 5.6 for WordPress has code injection.
CVE-2015-9272 1 Videowhisper 1 Video Presentation 2024-11-21 N/A
The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers to execute arbitrary code because vp/vw_upload.php considers a file safe when "html" are the last four characters, as demonstrated by a .phtml file containing PHP code.
CVE-2015-6970 1 Boschsecurity 2 Nbn-498 Dinion2x Day\/night Ip Cameras, Nbn-498 Dinion2x Day\/night Ip Cameras Firmware 2024-11-21 9.8 Critical
The web interface in Bosch Security Systems NBN-498 Dinion2X Day/Night IP Cameras with H.264 Firmware 4.54.0026 allows remote attackers to conduct XML injection attacks via the idstring parameter to rcp.xml.
CVE-2015-6461 1 Schneider-electric 22 Bmxnoc0401, Bmxnoc0401 Firmware, Bmxnoe0100 and 19 more 2024-11-21 N/A
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.
CVE-2015-5243 1 Phpwhois Project 1 Phpwhois 2024-11-21 N/A
phpWhois allows remote attackers to execute arbitrary code via a crafted whois record.
CVE-2015-3173 1 Custom Content Type Manager Project 1 Custom Content Type Manager 2024-11-21 7.2 High
custom-content-type-manager Wordpress plugin can be used by an administrator to achieve arbitrary PHP remote code execution.
CVE-2015-2968 1 Line 1 Line\@ 2024-11-21 5.9 Medium
LINE@ for Android version 1.0.0 and LINE@ for iOS version 1.0.0 are vulnerable to MITM (man-in-the-middle) attack since the application allows non-SSL/TLS communications. As a result, any API may be invoked from a script injected by a MITM (man-in-the-middle) attacker.