Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30882 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-40502 2 Angeljudesuarez, Hospital Management System Project 2 Hospital Management System, Hospital Management System 2025-05-16 9.8 Critical
SQL injection vulnerability in Hospital Management System Project in ASP.Net MVC 1 allows aremote attacker to execute arbitrary code via the btn_login_b_Click function of the Loginpage.aspx
CVE-2024-24302 1 Prestalife 1 Product Designer 2025-05-15 9.8 Critical
An issue was discovered in Tunis Soft "Product Designer" (productdesigner) module for PrestaShop before version 1.178.36, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the postProcess() method.
CVE-2024-25843 1 Prestashop 1 Import\/update Bulk Product 2025-05-15 9.8 Critical
In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions.
CVE-2024-25315 1 Hotel Management System Project 1 Hotel Management System 2025-05-15 9.8 Critical
Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2.
CVE-2024-25314 1 Hotel Management System Project 1 Hotel Management System 2025-05-15 9.8 Critical
Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.
CVE-2024-24543 1 Tenda 2 Ac9, Ac9 Firmware 2025-05-15 9.8 Critical
Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attacker to cause a denial of service or run arbitrary code via crafted overflow data.
CVE-2024-24495 1 Remyandrade 1 Daily Habit Tracker 2025-05-15 9.8 Critical
SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request.
CVE-2024-24398 1 Stimulsoft 1 Dashboards.php 2025-05-15 9.8 Critical
Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function.
CVE-2024-24393 1 Oaooa 1 Pichome 2025-05-15 9.8 Critical
File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request.
CVE-2024-24018 1 Xxyopen 1 Novel-plus 2025-05-15 9.8 Critical
A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass in crafted offset, limit, and sort parameters to perform SQL injection via /system/dataPerm/list
CVE-2024-24001 1 Jishenghua 1 Jsherp 2025-05-15 9.8 Critical
jshERP v3.3 is vulnerable to SQL Injection. via the com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findallocationDetail() function of jshERP which allows an attacker to construct malicious payload to bypass jshERP's protection mechanism.
CVE-2024-23978 1 Kddi 2 Home Spot Cube 2, Home Spot Cube 2 Firmware 2025-05-15 9.8 Critical
Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbitrary code may be executed. Note that the affected products are no longer supported.
CVE-2024-22852 1 Dlink 2 Go-rt-ac750, Go-rt-ac750 Firmware 2025-05-15 9.8 Critical
D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main. This vulnerability allows attackers to enable telnet service via a specially crafted payload.
CVE-2024-1284 2 Fedoraproject, Google 2 Fedora, Chrome 2025-05-15 9.8 Critical
Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2023-50026 1 Prestamonster 1 Multi Accessories Pro 2025-05-15 9.8 Critical
SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and before, allows remote attackers to escalate privileges and obtain sensitive information via the method HsAccessoriesGroupProductAbstract::getAccessoriesByIdProducts().
CVE-2023-42282 2 Fedorindutny, Redhat 6 Ip, Migration Toolkit Virtualization, Network Observ Optr and 3 more 2025-05-15 9.8 Critical
The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
CVE-2023-40266 1 Mitel 1 Unify Openscape Xpressions Webassistant 2025-05-15 9.8 Critical
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.
CVE-2023-38995 1 Schuhfried 1 Schuhfried 2025-05-15 9.8 Critical
An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.
CVE-2024-24811 1 Zope 1 Sqlalchemyda 2025-05-15 9.8 Critical
SQLAlchemyDA is a generic database adapter for ZSQL methods. A vulnerability found in versions prior to 2.2 allows unauthenticated execution of arbitrary SQL statements on the database to which the SQLAlchemyDA instance is connected. All users are affected. The problem has been patched in version 2.2. There is no workaround for the problem.
CVE-2022-41403 1 Newsletter Subscribe \(popup \+ Regular Module\) Project 1 Newsletter Subscribe \(popup \+ Regular Module\) 2025-05-15 9.8 Critical
OpenCart 3.x Newsletter Custom Popup was discovered to contain a SQL injection vulnerability via the email parameter at index.php?route=extension/module/so_newletter_custom_popup/newsletter.