Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30657 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-46640 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
SeaCMS 13.2 has a remote code execution vulnerability located in the file sql.class.chp. Although the system has a check function, the check function is not executed during execution, allowing remote code execution by writing to the file through the MySQL slow query method.
CVE-2024-54879 1 Seacms 1 Seacms 2025-03-28 9.1 Critical
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to recharge members indefinitely.
CVE-2024-54880 1 Seacms 1 Seacms 2025-03-28 9.1 Critical
SeaCMS V13.1 is vulnerable to Incorrect Access Control. A logic flaw can be exploited by an attacker to allow any user to register accounts in bulk.
CVE-2025-25516 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
CVE-2025-25517 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
CVE-2025-25519 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
CVE-2025-25520 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
CVE-2025-25521 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
CVE-2024-55461 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
CVE-2021-36879 1 Stylemixthemes 1 Ulisting 2025-03-28 9.8 Critical
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.
CVE-2024-29275 1 Seacms 1 Seacms 2025-03-28 9.8 Critical
SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive information via the id parameter in class.php.
CVE-2024-53438 1 Churchcrm 1 Churchcrm 2025-03-28 9.8 Critical
EventAttendance.php in ChurchCRM 5.7.0 is vulnerable to SQL injection. An attacker can exploit this vulnerability by manipulating the 'Event' parameter, which is directly interpolated into the SQL query without proper sanitization or validation, allowing attackers to execute arbitrary SQL commands.
CVE-2024-6057 1 Devolutions 1 Remote Desktop Manager 2025-03-28 9.8 Critical
Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the vault master password via the offline mode feature.
CVE-2024-2921 1 Devolutions 1 Devolutions Server 2025-03-28 9.8 Critical
Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific set of permissions.
CVE-2021-36888 1 Blocksera 1 Image Hover Effects 2025-03-28 9.8 Critical
Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate (versions <= 9.6.1) WordPress plugin.
CVE-2023-24612 1 Pdfbook Project 1 Pdfbook 2025-03-28 9.8 Critical
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
CVE-2022-48108 1 Dlink 2 Dir 878, Dir 878 Firmware 2025-03-28 9.8 Critical
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVE-2022-48107 1 Dlink 2 Dir 878, Dir 878 Firmware 2025-03-28 9.8 Critical
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVE-2022-48006 1 Taogogo 1 Taocms 2025-03-28 9.8 Critical
An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.
CVE-2022-23334 1 Ip-label 1 Newtest 2025-03-28 9.8 Critical
The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write access and escalate privileges via replacing NEWTESTREMOTEMANAGER.EXE.