Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30871 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-45017 1 Phpgurukul 1 Park Ticketing Management System 2025-05-09 9.8 Critical
A SQL injection vulnerability was discovered in edit-ticket.php of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the tprice POST request parameter.
CVE-2025-45018 1 Phpgurukul 1 Park Ticketing Management System 2025-05-09 9.8 Critical
A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the todate parameter.
CVE-2025-45019 1 Phpgurukul 1 Park Ticketing Management System 2025-05-09 9.8 Critical
A SQL injection vulnerability was discovered in /add-foreigners-ticket.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary code via the cprice POST request parameter.
CVE-2022-41415 1 Acer 2 Altos W2000h-w570h F4, Altos W2000h-w570h F4 Firmware 2025-05-08 9.8 Critical
Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable.
CVE-2021-38217 1 Sem-cms 1 Semcms 2025-05-08 9.8 Critical
SEMCMS v 1.2 is vulnerable to SQL Injection via SEMCMS_User.php.
CVE-2022-43184 1 Dlink 2 Dir-878, Dir-878 Firmware 2025-05-08 9.8 Critical
D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
CVE-2022-43168 1 Rukovoditel 1 Rukovoditel 2025-05-08 9.8 Critical
Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.
CVE-2022-43029 1 Tenda 2 Tx3, Tx3 Firmware 2025-05-08 9.8 Critical
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
CVE-2022-43028 1 Tenda 2 Tx3, Tx3 Firmware 2025-05-08 9.8 Critical
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg.
CVE-2022-43027 1 Tenda 2 Tx3, Tx3 Firmware 2025-05-08 9.8 Critical
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg.
CVE-2024-25302 1 Remyandrade 1 Event Student Attendance System 2025-05-08 9.8 Critical
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.
CVE-2024-24216 1 Easycorp 1 Zentao 2025-05-08 9.8 Critical
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
CVE-2024-24186 1 Jsish 1 Jsish 2025-05-08 9.8 Critical
Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.
CVE-2024-24112 1 Exrick 1 Xmall 2025-05-08 9.8 Critical
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVE-2024-24003 1 Jishenghua 1 Jsherp 2025-05-08 9.8 Critical
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
CVE-2022-3754 1 Phpmyfaq 1 Phpmyfaq 2025-05-08 9.8 Critical
Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CVE-2025-23211 1 Tandoor 1 Recipes 2025-05-08 10 Critical
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. A Jinja2 SSTI vulnerability allows any user to execute commands on the server. In the case of the provided Docker Compose file as root. This vulnerability is fixed in 1.5.24.
CVE-2024-25215 1 Sherlock 1 Employee Management System 2025-05-08 9.8 Critical
Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php.
CVE-2022-42021 1 Best Student Result Management System Project 1 Best Student Result Management System 2025-05-08 9.8 Critical
Best Student Result Management System v1.0 is vulnerable to SQL Injection via /upresult/upresult/notice-details.php?nid=.
CVE-2022-37298 1 Shinken-monitoring 1 Shinken Monitoring 2025-05-08 9.8 Critical
Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The SafeUnpickler class found in shinken/safepickle.py implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.