Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (325339 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-40753 3 Ibm, Linux, Microsoft 4 Aix, Infosphere Information Server, Linux Kernel and 1 more 2025-05-01 5.4 Medium
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 236688.
CVE-2020-8887 1 Telestream 2 Medius, Sentry 2025-05-01 7.5 High
Telestream Tektronix Medius before 10.7.5 and Sentry before 10.7.5 have a SQL injection vulnerability allowing an unauthenticated attacker to dump database contents via the page parameter in a page=login request to index.php (aka the server login page).
CVE-2025-24358 2025-05-01 N/A
gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2.
CVE-2022-46091 1 Oretnom23 1 Online Flight Booking Management System 2025-05-01 4.7 Medium
Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter.
CVE-2023-33676 1 Oretnom23 1 Lost And Found Information System 2025-05-01 8.4 High
Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*" which can be escalated to the remote command execution.
CVE-2024-28753 1 Raspap 1 Raspap 2025-05-01 6.5 Medium
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request.
CVE-2024-28754 1 Raspap 1 Raspap 2025-05-01 7.5 High
RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request.
CVE-2023-6444 1 Castos 1 Seriously Simple Podcasting 2025-05-01 5.3 Medium
The Seriously Simple Podcasting WordPress plugin before 3.0.0 discloses the Podcast owner's email address (which by default is the admin email address) via an unauthenticated crafted request.
CVE-2023-7247 1 Wp-buy 1 Login As User Or Customer \(user Switching\) 2025-05-01 4.9 Medium
The Login as User or Customer WordPress plugin through 3.8 does not prevent users to log in as any other user on the site.
CVE-2024-0561 2 Inisev, Themecheck 2 Ultimate Posts Widget, Ultimate Posts Widget 2025-05-01 5.4 Medium
The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-1068 1 Ajexperience 1 404 Solution 2025-05-01 7.2 High
The 404 Solution WordPress plugin before 2.35.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins.
CVE-2024-1273 1 Squirrly 1 Starbox 2025-05-01 6.1 Medium
The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
CVE-2024-28417 1 Webedition 1 Webedition Cms 2025-04-30 6.3 Medium
Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.
CVE-2024-28418 1 Webedition 1 Webedition Cms 2025-04-30 6.5 Medium
Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php
CVE-2024-37622 2 Rockoa, Xinhu 2 Xinhu, Rockoa 2025-04-30 6.1 Medium
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php.
CVE-2024-37623 1 Rockoa 1 Xinhu 2025-04-30 6.1 Medium
Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component.
CVE-2024-38469 1 Ibarn Project 1 Ibarn 2025-04-30 6.3 Medium
zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /pay.php.
CVE-2024-38470 1 Ibarn Project 1 Ibarn 2025-04-30 6.1 Medium
zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php.
CVE-2024-37799 2 Code-projects, Codeprojects 2 Restaurant Reservation System, Restaurant Reservation System 2025-04-30 5.4 Medium
CodeProjects Restaurant Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the reserv_id parameter at view_reservations.php.
CVE-2024-38275 1 Moodle 1 Moodle 2025-04-30 7.5 High
The cURL wrapper in Moodle retained the original request headers when following redirects, so HTTP authorization header information could be unintentionally sent in requests to redirect URLs.