Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (93332 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-24992 1 Cmswing 1 Cmswing 2024-11-21 5.4 Medium
There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when an administrator accesses the content management module.
CVE-2020-24963 1 Appsbd 1 Best Support System 2024-11-21 5.4 Medium
An Authenticated Persistent XSS vulnerability was discovered in the Best Support System, tested version v3.0.4.
CVE-2020-24924 1 Elkarbackup 1 Elkarbackup 2024-11-21 5.4 Medium
A Persistent Cross-site Scripting vulnerability is found in ElkarBackup v1.3.3, where an attacker can steal the user session cookie using this vulnerability present on Policies >> action >> Name Parameter
CVE-2020-24917 1 Enhancesoft 1 Osticket 2024-11-21 6.1 Medium
osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.
CVE-2020-24916 3 Canonical, Debian, Yaws 3 Ubuntu Linux, Debian Linux, Yaws 2024-11-21 9.8 Critical
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.
CVE-2020-24903 1 Cutesoft 1 Cute Editor 2024-11-21 6.1 Medium
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVE-2020-24902 1 Quixplorer Project 1 Quixplorer 2024-11-21 4.7 Medium
Quixplorer <=2.4.1 is vulnerable to reflected cross-site scripting (XSS) caused by improper validation of user supplied input. A remote attacker could exploit this vulnerability using a specially crafted URL to execute a script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVE-2020-24900 1 Krpano 1 Krpano 2024-11-21 6.1 Medium
The default installation of Krpano Panorama Viewer version <=1.20.8 is prone to Reflected XSS due to insecure XML load in file /viewer/krpano.html, parameter xml.
CVE-2020-24899 1 Nagios 1 Nagios Xi 2024-11-21 8.8 High
Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.
CVE-2020-24897 1 Stiltsoft 1 Table Filter And Charts For Confluence Server 2024-11-21 8.9 High
The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown markup to the "Table from CSV" macro.
CVE-2020-24876 1 Pancakeapp 1 Pancake 2024-11-21 9.8 Critical
Use of a hard-coded cryptographic key in Pancake versions < 4.13.29 allows an attacker to forge session cookies, which may lead to remote privilege escalation.
CVE-2020-24872 1 Lepton-cms 1 Leptoncms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in backend/pages/modify.php in Lepton-CMS version 4.7.0, allows remote attackers to execute arbitrary code.
CVE-2020-24870 2 Libraw, Redhat 2 Libraw, Enterprise Linux 2024-11-21 8.8 High
Libraw before 0.20.1 has a stack buffer overflow via LibRaw::identify_process_dng_fields in identify.cpp.
CVE-2020-24863 2 Freebsd, Midnightbsd 2 Freebsd, Midnightbsd 2024-11-21 5.5 Medium
A memory corruption vulnerability was found in the kernel function kern_getfsstat in MidnightBSD before 1.2.7 and 1.3 through 2020-08-19, and FreeBSD through 11.4, that allows an attacker to trigger an invalid free and crash the system via a crafted size value in conjunction with an invalid mode.
CVE-2020-24861 1 Get-simple 1 Getsimple Cms 2024-11-21 5.4 Medium
GetSimple CMS 3.3.16 allows in parameter 'permalink' on the Settings page persistent Cross Site Scripting which is executed when you create and open a new page
CVE-2020-24860 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 5.4 Medium
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.
CVE-2020-24849 1 Fruitywifi Project 1 Fruitywifi 2024-11-21 8.8 High
A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page, it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.
CVE-2020-24842 1 Sdgc 1 Pnpscada 2024-11-21 6.1 Medium
PNPSCADA 2.200816204020 allows cross-site scripting (XSS), which can execute arbitrary JavaScript in the victim's browser.
CVE-2020-24826 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the elf::section::as_strtab function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.
CVE-2020-24825 1 Libelfin Project 1 Libelfin 2024-11-21 5.5 Medium
A vulnerability in the line_table::line_table function of Libelfin v0.3 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted ELF file.