Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30856 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-44801 1 Dlink 2 Dir-878, Dir-878 Firmware 2025-04-29 9.8 Critical
D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.
CVE-2022-44202 1 Dlink 2 Dir-878, Dir-878 Firmware 2025-04-29 9.8 Critical
D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.
CVE-2022-44172 1 Tenda 2 Ac18, Ac18 Firmware 2025-04-29 9.8 Critical
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
CVE-2022-44171 1 Tenda 2 Ac18, Ac18 Firmware 2025-04-29 9.8 Critical
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
CVE-2022-43143 1 Beekeeperstudio 1 Beekeeper-studio 2025-04-29 9.6 Critical
A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error modal container.
CVE-2022-36786 1 Dlink 2 Dsl-224, Dsl-224 Firmware 2025-04-29 9.9 Critical
DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.
CVE-2025-22929 1 Os4ed 1 Opensis 2025-04-29 9.8 Critical
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the filter_id parameter at /students/StudentFilters.php.
CVE-2025-22930 1 Os4ed 1 Opensis 2025-04-29 9.8 Critical
OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the groupid parameter at /messaging/Group.php.
CVE-2022-39180 1 College Management System Project 1 College Management System 2025-04-29 9.8 Critical
College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page
CVE-2022-45474 1 Drachtio 1 Drachtio-server 2025-04-29 9.8 Critical
drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.
CVE-2022-4116 2 Quarkus, Redhat 3 Quarkus, Build Of Quarkus, Quarkus 2025-04-29 9.8 Critical
A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote code execution.
CVE-2022-3634 1 Ciphercoin 1 Contact Form 7 Database Addon 2025-04-29 9.8 Critical
The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection
CVE-2024-37407 1 Libarchive 1 Libarchive 2025-04-29 9.1 Critical
Libarchive before 3.7.4 allows name out-of-bounds access when a ZIP archive has an empty-name file and mac-ext is enabled. This occurs in slurp_central_directory in archive_read_support_format_zip.c.
CVE-2025-29209 1 Totolink 2 X18, X18 Firmware 2025-04-29 9.8 Critical
TOTOLINK X18 v9.1.0cu.2024_B20220329 has an unauthorized arbitrary command execution in the enable parameter' of the sub_41105C function of cstecgi .cgi.
CVE-2025-28137 1 Totolink 2 A810r, A810r Firmware 2025-04-29 9.8 Critical
The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
CVE-2025-29064 1 Totolink 2 X18, X18 Firmware 2025-04-29 9.8 Critical
An issue in TOTOLINK x18 v.9.1.0cu.2024_B20220329 allows a remote attacker to execute arbitrary code via the sub_410E54 function of the cstecgi.cgi.
CVE-2025-28024 1 Totolink 2 A810r, A810r Firmware 2025-04-29 9.8 Critical
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the cstecgi.cgi
CVE-2025-28034 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2025-04-29 9.8 Critical
TOTOLINK A800R V4.1.2cu.5137_B20200730, A810R V4.1.2cu.5182_B20201026, A830R V4.1.2cu.5182_B20201102, A950RG V4.1.2cu.5161_B20200903, A3000RU V5.9c.5185_B20201128, and A3100R V4.1.2cu.5247_B20211129 were found to contain a pre-auth remote command execution vulnerability in the NTPSyncWithHost function through the hostTime parameter.
CVE-2025-31685 1 Getopensocial 1 Open Social 2025-04-29 9.1 Critical
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
CVE-2022-44785 1 Maggioli 1 Appalti \& Contratti 2025-04-29 9.8 Critical
An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.