Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357836 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-46544 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand.
CVE-2022-46543 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat.
CVE-2022-46542 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat.
CVE-2022-46535 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState.
CVE-2022-46534 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan.
CVE-2022-46533 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState.
CVE-2022-46530 1 Tenda 2 F1203, F1203 Firmware 2025-04-16 7.5 High
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo.
CVE-2022-46435 1 Tp-link 6 Tl-wr941nd V2, Tl-wr941nd V2 Firmware, Tl-wr941nd V3 and 3 more 2025-04-16 8.8 High
An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVE-2022-46434 1 Tp-link 2 Tl-wa7510n V1, Tl-wa7510n V1 Firmware 2025-04-16 7.5 High
An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
CVE-2022-46432 1 Tp-link 2 Tl-wr743nd V1, Tl-wr743nd V1 Firmware 2025-04-16 7.5 High
An exploitable firmware modification vulnerability was discovered on TP-Link TL-WR743ND V1. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify the user-uploaded firmware image and bypass the CRC check, allowing attackers to execute arbitrary code or cause a Denial of Service (DoS). This affects v3.12.20 and earlier.
CVE-2022-46430 1 Tp-link 8 Tl-wr740n V1, Tl-wr740n V1 Firmware, Tl-wr740n V2 and 5 more 2025-04-16 4.8 Medium
TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image during the firmware update process.
CVE-2022-46421 1 Apache 1 Apache-airflow-providers-apache-hive 2025-04-16 9.8 Critical
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.
CVE-2022-46096 1 Covid-19 Directory On Vaccination System Project 1 Covid-19 Directory On Vaccination System 2025-04-16 6.1 Medium
A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execute arbitrary code via the txtfullname parameter or txtphone parameter to register.php without logging in.
CVE-2022-46095 1 Covid-19 Directory On Vaccination System Project 1 Covid-19 Directory On Vaccination System 2025-04-16 6.1 Medium
Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verification.php because the program does not verify the txtvaccinationID parameter.
CVE-2022-44449 1 Zenphoto 1 Zenphoto 2025-04-16 6.1 Medium
Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
CVE-2022-43543 3 Docomo, Kddi, Softbank 3 \+ Message, \+ Message, \+ Message 2025-04-16 5.4 Medium
KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Message App displays text unprocessed, even when control characters are contained, and the text is shown based on Unicode control character's specifications. Therefore, a crafted text may display misleading web links. As a result, a spoofed URL may be displayed and phishing attacks may be conducted. Affected products and versions are as follows: KDDI +Message App for Android prior to version 3.9.2 and +Message App for iOS prior to version 3.9.4, NTT DOCOMO +Message App for Android prior to version 54.49.0500 and +Message App for iOS prior to version 3.9.4, and SoftBank +Message App for Android prior to version 12.9.5 and +Message App for iOS prior to version 3.9.4
CVE-2022-40841 1 Ndk-design 1 Ndkadvancedcustomizationfields 2025-04-16 6.1 Medium
A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter.
CVE-2022-36222 1 Nokia 2 Fastmile, Fastmile Firmware 2025-04-16 8.4 High
Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally to access the web admin interface.
CVE-2022-36221 1 Nokia 2 Fastmile, Fastmile Firmware 2025-04-16 6.5 Medium
Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system.
CVE-2022-25931 1 Easy-static-server Project 1 Easy-static-server 2025-04-16 7.5 High
All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url user input that is passed to the server code.