Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30856 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-41326 1 Mitel 1 Micollab 2025-04-29 9.8 Critical
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the application.
CVE-2022-40842 1 Ndk-design 1 Ndkadvancedcustomizationfields 2025-04-29 9.1 Critical
ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php.
CVE-2022-36180 1 Fusiondirectory 1 Fusiondirectory 2025-04-29 9.6 Critical
Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidparameter&plug={Injection], /fusiondirectory/index.php?signout=1&message=[injection]&plug=106.
CVE-2022-36179 1 Fusiondirectory 1 Fusiondirectory 2025-04-29 9.8 Critical
Fusiondirectory 1.3 suffers from Improper Session Handling.
CVE-2021-3919 1 Hp 106 Command Center, Envy 13t-bd100, Envy 13z-ay100 and 103 more 2025-04-29 9.8 Critical
A potential security vulnerability has been identified in OMEN Gaming Hub and in HP Command Center which may allow escalation of privilege and/or denial of service. HP has released software updates to mitigate the potential vulnerability.
CVE-2020-23591 1 Optilinknetwork 2 Op-xt71000n, Op-xt71000n Firmware 2025-04-29 9.8 Critical
A vulnerability in OPTILINK OP-XT71000N Hardware Version: V2.2 , Firmware Version: OP_V3.3.1-191028 allows an attacker to upload arbitrary files through " /mgm_dev_upgrade.asp " which can "delete every file for Denial of Service (using 'rm -rf *.*' in the code), reverse connection (using '.asp' webshell), backdoor.
CVE-2025-28035 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2025-04-29 9.8 Critical
TOTOLINK A830R V4.1.2cu.5182_B20201102 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
CVE-2025-28036 1 Totolink 12 A3000ru, A3000ru Firmware, A3100r and 9 more 2025-04-29 9.8 Critical
TOTOLINK A950RG V4.1.2cu.5161_B20200903 was found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter.
CVE-2025-28037 1 Totolink 4 A810r, A810r Firmware, A950rg and 1 more 2025-04-29 9.8 Critical
TOTOLINK A810R V4.1.2cu.5182_B20201026 and A950RG V4.1.2cu.5161_B20200903 were found to contain a pre-auth remote command execution vulnerability in the setDiagnosisCfg function through the ipDomain parameter.
CVE-2025-28038 1 Totolink 2 Ex1200t, Ex1200t Firmware 2025-04-29 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setWebWlanIdx function through the webWlanIdx parameter.
CVE-2025-28039 1 Totolink 2 Ex1200t, Ex1200t Firmware 2025-04-29 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5232_B20210713 was found to contain a pre-auth remote command execution vulnerability in the setUpgradeFW function through the FileName parameter.
CVE-2022-45207 1 Jeecg 1 Jeecg Boot 2025-04-29 9.8 Critical
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString.
CVE-2022-45206 1 Jeecg 1 Jeecg Boot 2025-04-29 9.8 Critical
Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check.
CVE-2022-45152 2 Fedoraproject, Moodle 3 Extra Packages For Enterprise Linux, Fedora, Moodle 2025-04-29 9.1 Critical
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems. This vulnerability allows a remote attacker to perform SSRF attacks.
CVE-2022-44844 1 Totolink 2 A7100ru, A7100ru Firmware 2025-04-29 9.8 Critical
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function.
CVE-2022-44843 1 Totolink 2 A7100ru, A7100ru Firmware 2025-04-29 9.8 Critical
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg function.
CVE-2022-44262 1 Ff4j 1 Ff4j 2025-04-29 9.8 Critical
ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).
CVE-2022-44001 1 Backclick 1 Backclick 2025-04-29 9.8 Critical
An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed.
CVE-2022-41705 1 Uatech 1 Badaso 2025-04-29 9.8 Critical
Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
CVE-2025-30356 1 Nasa 1 Cryptolib 2025-04-29 9.8 Critical
CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between a spacecraft running the core Flight System (cFS) and a ground station. In 1.3.3 and earlier, a heap buffer overflow vulnerability persists in the Crypto_TC_ApplySecurity function due to an incomplete validation check on the fl (frame length) field. Although CVE-2025-29912 addressed an underflow issue involving fl, the patch fails to fully prevent unsafe calculations. As a result, an attacker can still craft malicious frames that cause a negative tf_payload_len, which is then interpreted as a large unsigned value, leading to a heap buffer overflow in a memcpy call.