Export limit exceeded: 109214 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109214 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-12878 | 1 Thedevoice | 1 Lazy Blocks | 2025-05-15 | 7.1 High |
| The Custom Block Builder WordPress plugin before 3.8.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-10483 | 1 Simplepress | 1 Simplepress | 2025-05-15 | 7.1 High |
| The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. | ||||
| CVE-2024-10152 | 1 Elementengage | 1 Simple Certain Time To Show Content | 2025-05-15 | 7.1 High |
| The Simple Certain Time to Show Content WordPress plugin before 1.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2025-4058 | 1 Projectworlds | 1 Online Examination System | 2025-05-15 | 7.3 High |
| A vulnerability classified as critical has been found in Projectworlds Online Examination System 1.0. This affects an unknown part of the file /Bloodgroop_process.php. The manipulation of the argument Pat_BloodGroup1 leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-1964 | 1 Projectworlds | 1 Online Hotel Booking | 2025-05-15 | 7.3 High |
| A vulnerability was found in projectworlds Online Hotel Booking 1.0. It has been rated as critical. This issue affects some unknown processing of the file /booknow.php?roomname=Duplex. The manipulation of the argument checkin leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | ||||
| CVE-2024-25447 | 1 Enlightenment | 1 Imlib2 | 2025-05-15 | 8.8 High |
| An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafted image. | ||||
| CVE-2024-25419 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_menu.php. | ||||
| CVE-2024-25418 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_menu.php. | ||||
| CVE-2024-25305 | 1 Code-projects | 1 Simple School Management System | 2025-05-15 | 8.8 High |
| Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php. | ||||
| CVE-2024-25304 | 1 Code-projects | 1 Simple School Management System | 2025-05-15 | 8.8 High |
| Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php." | ||||
| CVE-2024-25004 | 1 9bis | 1 Kitty | 2025-05-15 | 7.8 High |
| KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds checking and input sanitization (at line 2600). This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution. | ||||
| CVE-2024-24468 | 1 Flusity | 1 Flusity | 2025-05-15 | 8.8 High |
| Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add_customblock.php. | ||||
| CVE-2024-24113 | 1 Xuxueli | 1 Xxl-job | 2025-05-15 | 8.8 High |
| xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. | ||||
| CVE-2024-23756 | 1 Plone | 1 Plone | 2025-05-15 | 7.5 High |
| The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them. | ||||
| CVE-2024-23749 | 1 9bis | 1 Kitty | 2025-05-15 | 7.8 High |
| KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution. | ||||
| CVE-2024-23660 | 1 Binance | 1 Trust Wallet | 2025-05-15 | 7.5 High |
| The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and consequently generates mnemonic words for which the device time is the only entropy source, leading to economic losses, as exploited in the wild in July 2023. An attacker can systematically generate mnemonics for each timestamp within an applicable timeframe, and link them to specific wallet addresses in order to steal funds from those wallets. | ||||
| CVE-2024-22520 | 1 Dronetag | 1 Drone Scanner | 2025-05-15 | 8.2 High |
| An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets. | ||||
| CVE-2024-22237 | 1 Vmware | 1 Aria Operations For Networks | 2025-05-15 | 7.8 High |
| Aria Operations for Networks contains a local privilege escalation vulnerability. A console user with access to Aria Operations for Networks may exploit this vulnerability to escalate privileges to gain root access to the system. | ||||
| CVE-2024-22107 | 1 Gttb | 1 Gtb Central Console | 2025-05-15 | 7.2 High |
| An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api/system/dns/data endpoint. An authenticated attacker can abuse it to inject an arbitrary command and compromise the platform. | ||||
| CVE-2024-20813 | 1 Samsung | 1 Android | 2025-05-15 | 8.4 High |
| Out-of-bounds Write in padmd_vld_qtbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code. | ||||