Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (342404 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-47318 4 Debian, Fedoraproject, Redhat and 1 more 4 Debian Linux, Fedora, Satellite and 1 more 2025-04-04 8.8 High
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
CVE-2022-39195 1 Lsoft 1 Listserv 2025-04-04 6.1 Medium
A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter.
CVE-2021-37774 1 Tp-link 2 Tl-wdr7660, Tl-wdr7660 Firmware 2025-04-04 8 High
An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code.
CVE-2021-36630 1 Ruckuswireless 8 Sz-100, Sz-100 Firmware, Sz-144 and 5 more 2025-04-04 7.5 High
DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform DOS attacks via crafted request.
CVE-2024-31012 1 Sem-cms 1 Semcms 2025-04-04 9.8 Critical
An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the upload.php file.
CVE-2024-30860 1 Netentsec 3 Application Security Gateway, Ns-asg, Ns-asg Firmware 2025-04-04 8.8 High
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/export_excel_user.php.
CVE-2024-30861 1 Netentsec 2 Ns-asg, Ns-asg Firmware 2025-04-04 5.3 Medium
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/configguide/ipsec_guide_1.php.
CVE-2024-30858 2 Netentsec, Ns Asg 3 Ns-asg, Ns-asg Firmware, Ns Asg 2025-04-04 9.8 Critical
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_fire_wall.php.
CVE-2024-30859 1 Netentsec 2 Ns-asg, Ns-asg Firmware 2025-04-04 8.8 High
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/config_ISCGroupSSLCert.php.
CVE-2024-30862 1 Netentsec 2 Ns-asg, Ns-asg Firmware 2025-04-04 8.8 High
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /3g/index.php.
CVE-2024-30863 1 Netentsec 2 Ns-asg, Ns-asg Firmware 2025-04-04 6.3 Medium
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /WebPages/history.php.
CVE-2024-30867 1 Netentsec 2 Ns-asg, Ns-asg Firmware 2025-04-04 9.8 Critical
netentsec NS-ASG 6.3 is vulnerable to SQL Injection via /admin/edit_virtual_site_info.php.
CVE-2023-6957 1 Fluentforms 1 Contact Form 2025-04-04 4.9 Medium
The Fluent Forms plugin for WordPress by Fluent Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.1.9 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploitation level depends on who is granted the right to create forms by an administrator. This level can be as low as contributor, but by default is admin.
CVE-2024-53635 1 Phpgurukul 1 Covid19 Testing Management System 2025-04-04 4.8 Medium
A Reflected Cross Site Scripting (XSS) vulnerability was found in /covid-tms/patient-search-report.php in PHPGurukul COVID 19 Testing Management System v1.0, which allows remote attackers to execute arbitrary code via the searchdata POST request parameter.
CVE-2025-25604 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6.5 Medium
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the vif_disable function in mtkwifi.lua.
CVE-2025-25605 1 Totolink 2 X5000r, X5000r Firmware 2025-04-04 6.5 Medium
Totolink X5000R V9.1.0u.6369_B20230113 is vulnerable to command injection via the apcli_wps_gen_pincode function in mtkwifi.lua.
CVE-2025-25768 1 Mrcms 1 Mrcms 2025-04-04 5.4 Medium
MRCMS v3.1.2 was discovered to contain a server-side template injection (SSTI) vulnerability in the component \servlet\DispatcherServlet.java. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
CVE-2025-1850 1 Codezips 1 College Management System 2025-04-04 7.3 High
A vulnerability, which was classified as critical, has been found in Codezips College Management System 1.0. Affected by this issue is some unknown functionality of the file /university.php. The manipulation of the argument book_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-4743 1 Iteachyou 1 Dreamer Cms 2025-04-04 3.1 Low
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been classified as problematic. Affected is an unknown function of the file /upload/ueditorConfig?action=config. The manipulation leads to files or directories accessible. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-238632. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-2473 1 Iteachyou 1 Dreamer Cms 2025-04-04 4.3 Medium
A vulnerability was found in Dreamer CMS up to 4.1.3. It has been declared as problematic. This vulnerability affects the function updatePwd of the file UserController.java of the component Password Hash Calculation. The manipulation leads to inefficient algorithmic complexity. The attack can be initiated remotely. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-227860.