Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10227 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-14195 2 Carmelogarcia, Code-projects 2 Employee Profile Management System, Employee Profile Management System 2025-12-10 6.3 Medium
A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_query.php. The manipulation of the argument per_file results in unrestricted upload. The attack may be launched remotely. The exploit has been released to the public and may be exploited.
CVE-2025-14219 1 Campcodes 1 Retro Basketball Shoes Online Store 2025-12-10 4.7 Medium
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/admin_running.php. Executing manipulation of the argument product_image can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited.
CVE-2024-29843 1 Cs-technologies 1 Evolution 2025-12-10 7.5 High
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on MOBILE_GET_USERS_LIST, allowing for an unauthenticated attacker to enumerate all users and their access levels
CVE-2024-29842 1 Cs-technologies 1 Evolution 2025-12-10 7.5 High
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS, allowing for an unauthenticated attacker to return the abacard field of any user
CVE-2024-29840 1 Cs-technologies 1 Evolution 2025-12-10 7.5 High
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS, allowing for an unauthenticated attacker to return the pin value of any user
CVE-2024-29841 1 Cs-technologies 1 Evolution 2025-12-10 7.5 High
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS, allowing for an unauthenticated attacker to return the keys value of any user
CVE-2024-29837 1 Cs-technologies 1 Evolution 2025-12-10 8.8 High
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below uses poor session management, allowing for an unauthenticated attacker to access administrator functionality if any other user is already signed in.
CVE-2024-29836 1 Cs-technologies 1 Evolution 2025-12-10 9.8 Critical
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control, allowing for an unauthenticated attacker to update and add user profiles within the application, and gain full access of the site.
CVE-2024-29839 1 Cs-technologies 1 Evolution 2025-12-10 7.5 High
The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOP_EDIT_USER_GET_CARD, allowing for an unauthenticated attacker to return the card value data of any user
CVE-2025-66200 1 Apache 1 Http Server 2025-12-10 5.4 Medium
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
CVE-2024-38164 1 Microsoft 1 Groupme 2025-12-09 9.6 Critical
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.
CVE-2024-38099 1 Microsoft 9 Windows Server 2008, Windows Server 2008 R2, Windows Server 2008 Sp2 and 6 more 2025-12-09 5.9 Medium
Windows Remote Desktop Licensing Service Denial of Service Vulnerability
CVE-2024-38100 1 Microsoft 5 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 2 more 2025-12-09 7.8 High
Windows File Explorer Elevation of Privilege Vulnerability
CVE-2024-38061 1 Microsoft 22 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 19 more 2025-12-09 7.5 High
DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability
CVE-2024-30061 1 Microsoft 1 Dynamics 365 2025-12-09 7.3 High
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
CVE-2025-59810 1 Fortinet 3 Fortisoar, Fortisoaron-premise, Fortisoarpaas 2025-12-09 6.2 Medium
An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.2, FortiSOAR on-premise 7.5.0 through 7.5.1, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow information disclosure to an authenticated attacker via crafted requests
CVE-2024-12125 1 Redhat 1 Red Hat 3scale Amp 2025-12-09 7.5 High
A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information.
CVE-2025-14206 2 Senior-walter, Sourcecodester 2 Online Student Clearance System, Online Student Clearance System 2025-12-09 6.5 Medium
A vulnerability was determined in SourceCodester Online Student Clearance System 1.0. The affected element is an unknown function of the file /Admin/delete-fee.php of the component Fee Table Handler. Executing manipulation of the argument ID can lead to improper authorization. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2025-65796 1 Usememos 1 Memos 2025-12-09 4.3 Medium
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos.
CVE-2025-65798 1 Usememos 1 Memos 2025-12-09 5.4 Medium
Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users.