Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30656 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-47780 1 Bangresto Project 1 Bangresto 2025-03-27 9.8 Critical
SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.
CVE-2022-47714 1 Lastyard 1 Last Yard 2025-03-27 9.8 Critical
Last Yard 22.09.8-1 does not enforce HSTS headers
CVE-2022-47699 1 Comfast Project 2 Cf-wr623n, Cf-wr623n Firmware 2025-03-27 9.8 Critical
COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control.
CVE-2022-47003 1 Murasoftware 1 Mura Cms 2025-03-27 9.8 Critical
A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
CVE-2022-28331 3 Apache, Microsoft, Redhat 4 Portable Runtime, Windows, Jboss Core Services and 1 more 2025-03-27 9.8 Critical
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
CVE-2022-24963 2 Apache, Redhat 4 Portable Runtime, Enterprise Linux, Jboss Core Services and 1 more 2025-03-27 9.8 Critical
Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0.
CVE-2023-39612 1 Filebrowser 1 Filebrowser 2025-03-27 9.0 Critical
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.
CVE-2023-22900 1 Thinkingsoftware 1 Efence 2025-03-27 9.8 Critical
Efence login function has insufficient validation for user input. An unauthenticated remote attacker can exploit this vulnerability to inject arbitrary SQL commands to access, modify or delete database.
CVE-2022-48079 1 Mengnai 1 Aapanel Host System 2025-03-27 9.8 Critical
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.
CVE-2021-36503 1 Native-php-cms Project 1 Native-php-cms 2025-03-27 9.8 Critical
SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php file.
CVE-2022-22486 1 Ibm 1 Tivoli Workload Scheduler 2025-03-27 10 Critical
IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 226328.
CVE-2024-9574 1 Soplanning 1 Soplanning 2025-03-27 9.8 Critical
SQL injection vulnerability in SOPlanning <1.45, via /soplanning/www/user_groupes.php in the by parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB.
CVE-2024-44551 1 Tenda 2 Ax1806, Ax1806 Firmware 2025-03-26 9.8 Critical
Tenda AX1806 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
CVE-2023-41014 1 Code-projects 1 Online Job Portal 2025-03-26 9.8 Critical
code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."
CVE-2021-37315 1 Asus 2 Rt-ac68u, Rt-ac68u Firmware 2025-03-26 9.1 Critical
Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to write arbitrary files via improper sanitation on the source for COPY and MOVE operations.
CVE-2024-21082 1 Oracle 1 Bi Publisher 2025-03-26 9.8 Critical
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.0.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in takeover of Oracle BI Publisher. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2022-48114 1 Ruoyi 1 Ruoyi 2025-03-26 9.8 Critical
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
CVE-2022-48113 1 Totolink 2 N200re-v5, N200re-v5 Firmware 2025-03-26 9.8 Critical
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
CVE-2022-48082 1 Easyone 1 Easyone Crm 2025-03-26 9.8 Critical
Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
CVE-2022-48078 1 Pycdc Project 1 Pycdc 2025-03-26 9.8 Critical
pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.