Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30903 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-37226 1 Loftware 1 Spectrum 2025-05-29 9.8 Critical
Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.
CVE-2023-37227 1 Loftware 1 Spectrum 2025-05-29 9.8 Critical
Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.
CVE-2023-37231 1 Loftware 1 Spectrum 2025-05-29 9.8 Critical
Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.
CVE-2024-51360 1 Phpgurukul 1 Hospital Management System 2025-05-29 9.8 Critical
An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php file
CVE-2024-51101 1 Phpgurukul 1 Restaurant Table Booking System 2025-05-29 9.8 Critical
PHPGURUKUL Restaurant Table Booking System using PHP and MySQL v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /rtbs/check-status.php.
CVE-2024-23739 2 Apple, Discord 2 Macos, Discord 2025-05-29 9.8 Critical
An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.
CVE-2024-20253 1 Cisco 5 Unified Communications Manager, Unified Communications Manager Im And Presence Service, Unified Contact Center Express and 2 more 2025-05-29 9.9 Critical
A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to the improper processing of user-provided data that is being read into memory. An attacker could exploit this vulnerability by sending a crafted message to a listening port of an affected device. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with the privileges of the web services user. With access to the underlying operating system, the attacker could also establish root access on the affected device.
CVE-2023-52389 1 Pocoproject 1 Poco 2025-05-29 9.8 Critical
UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::convert() and Poco::UTF32::queryConvert() may return a negative integer if a UTF-32 byte sequence evaluates to a value of 0x80000000 or higher. This is fixed in 1.11.8p2, 1.12.5p2, and 1.13.0.
CVE-2023-51840 1 Html-js 1 Doracms 2025-05-29 9.8 Critical
DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
CVE-2023-38323 1 Opennds 1 Opennds 2025-05-29 9.8 Critical
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the status path script entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
CVE-2022-38509 1 Wedding Planner Project 1 Wedding Planner 2025-05-29 9.8 Critical
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking_id parameter at /admin/budget.php.
CVE-2022-28321 2 Linux-pam, Opensuse 2 Linux-pam, Tumbleweed 2025-05-29 9.8 Critical
The Linux-PAM package before 1.5.2-6.1 for openSUSE Tumbleweed allows authentication bypass for SSH logins. The pam_access.so module doesn't correctly restrict login if a user tries to connect from an IP address that is not resolvable via DNS. In such conditions, a user with denied access to a machine can still get access. NOTE: the relevance of this issue is largely limited to openSUSE Tumbleweed and openSUSE Factory; it does not affect Linux-PAM upstream.
CVE-2024-40392 2 Fkgeo, Pharmacy Medical Store And Sale Point Project 2 Pharmacy\/medical Store Point Of Sale System, Pharmacy Medical Store And Sale Point 2025-05-29 9.8 Critical
SourceCodester Pharmacy/Medical Store Point of Sale System Using PHP/MySQL and Bootstrap Framework with Source Code 1.0 was discovered to contain a SQL injection vulnerability via the name parameter under addnew.php.
CVE-2024-41603 1 Denkgroot 1 Spina 2025-05-29 9.6 Critical
Spina CMS v2.18.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the URI /admin/layout.
CVE-2024-50694 1 Sungrowpower 2 Winet-s, Winet-s Firmware 2025-05-29 9.8 Critical
In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when copying the timestamp read from an MQTT message, the underlying code does not check the bounds of the buffer that is used to store the message. This may lead to a stack-based buffer overflow.
CVE-2024-50695 1 Sungrowpower 2 Winet-s, Winet-s Firmware 2025-05-29 9.8 Critical
SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to stack-based buffer overflow when parsing MQTT messages, due to missing MQTT topic bounds checks.
CVE-2024-57590 1 Trendnet 2 Tew-632brp, Tew-632brp Firmware 2025-05-29 9.8 Critical
TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntp_server" passed to the "ntp_sync.cgi" binary through a POST request.
CVE-2025-44884 1 Planet 2 Wgs-804hpt, Wgs-804hpt Firmware 2025-05-29 9.8 Critical
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function.
CVE-2025-44885 1 Planet 2 Wgs-804hpt, Wgs-804hpt Firmware 2025-05-29 9.8 Critical
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function.
CVE-2025-44886 1 Planet 2 Wgs-804hpt, Wgs-804hpt Firmware 2025-05-29 9.8 Critical
FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postcontains function.