Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (38 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-50166 1 Pega 1 Platform 2025-06-11 6.1 Medium
Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
CVE-2017-11355 1 Pega 1 Pega Platform 2025-04-20 N/A
Multiple cross-site scripting (XSS) vulnerabilities in PEGA Platform 7.2 ML0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO to the main page; the (2) beanReference parameter to the JavaBean viewer page; or the (3) pyTableName to the System database schema modification page.
CVE-2017-11356 1 Pega 1 Pega Platform 2025-04-20 N/A
The application distribution export functionality in PEGA Platform 7.2 ML0 and earlier allows remote authenticated users with certain privileges to obtain sensitive configuration information by leveraging a missing access control.
CVE-2023-50168 1 Pega 1 Pega Platform 2025-03-10 7.7 High
Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.
CVE-2023-50167 1 Pega 1 Pega Platform 2025-02-18 5.4 Medium
Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.
CVE-2023-26466 1 Pega 1 Synchronization Engine 2025-02-10 7.8 High
A user with non-Admin access can change a configuration file on the client to modify the Server URL.
CVE-2023-26467 1 Pega 1 Synchronization Engine 2025-02-07 5.4 Medium
A man in the middle can redirect traffic to a malicious server in a compromised configuration.
CVE-2023-28093 1 Pega 1 Synchronization Engine 2025-02-07 6.5 Medium
A user with a compromised configuration can start an unsigned binary as a service.
CVE-2023-26465 1 Pega 1 Pega Platform 2025-01-06 6.1 Medium
Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.
CVE-2023-28094 1 Pega 1 Pega Platform 2024-12-06 8.1 High
Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be utilizing default credentials.
CVE-2023-50165 1 Pega 1 Platform 2024-11-21 8.5 High
Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.
CVE-2023-4843 1 Pega 1 Pega Platform 2024-11-21 4.3 Medium
Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however this field can only be modified by an authenticated administrative user.
CVE-2023-32090 2 Pega, Pegasystems 2 Pega Platform, Pega Platform 2024-11-21 9.8 Critical
Pega platform clients who are using versions 6.1 through 7.3.1 may be utilizing default credentials
CVE-2023-32089 1 Pega 1 Platform 2024-11-21 4.6 Medium
Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description
CVE-2023-32088 1 Pega 1 Platform 2024-11-21 4.6 Medium
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation
CVE-2023-32087 1 Pega 1 Platform 2024-11-21 4.6 Medium
Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation
CVE-2022-35656 1 Pega 1 Pega Platform 2024-11-21 4.5 Medium
Pega Platform from 8.3 to 8.7.3 vulnerability may allow authenticated security administrators to alter CSRF settings directly.
CVE-2022-35655 1 Pega 1 Pega Platform 2024-11-21 6.1 Medium
Pega Platform from 7.3 to 8.7.3 is affected by an XSS issue due to a misconfiguration of a datapage setting.
CVE-2022-35654 1 Pega 1 Pega Platform 2024-11-21 6.1 Medium
Pega Platform from 8.5.4 to 8.7.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.
CVE-2022-24083 1 Pega 1 Infinity 2024-11-21 9.8 Critical
Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks.