Search

Expected end of text, found ',' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (403704 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-23814 1 Unisharp 1 Laravel-filemanager 2025-06-17 6.7 Medium
This affects versions of the package unisharp/laravel-filemanager before 2.6.2. The upload() function does not sufficiently validate the file type when uploading. An attacker may be able to reproduce the following steps: 1. Install a package with a web Laravel application. 2. Navigate to the Upload window 3. Upload an image file, then capture the request 4. Edit the request contents with a malicious file (webshell) 5. Enter the path of file uploaded on URL - Remote Code Execution **Note:** Prevention for bad extensions can be done by using a whitelist in the config file(lfm.php). Corresponding document can be found in [here](https://unisharp.github.io/laravel-filemanager/configfolder-categories).
CVE-2024-47196 1 Siemens 2 Modelsim, Questa 2025-06-17 6.7 Medium
A vulnerability has been identified in ModelSim (All versions < V2025.2), Questa (All versions < V2025.2). vsimk.exe in affected applications allows a specific tcl file to be loaded from the current working directory. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges in installations where administrators or processes with elevated privileges launch vsimk.exe from a user-writable directory.
CVE-2022-45699 1 Apsystems 2 Ecu-r, Ecu-r Firmware 2025-06-17 9.8 Critical
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
CVE-2025-52445 2025-06-17 N/A
Not used
CVE-2025-52444 2025-06-17 N/A
Not used
CVE-2025-52443 2025-06-17 N/A
Not used
CVE-2025-52442 2025-06-17 N/A
Not used
CVE-2025-52441 2025-06-17 N/A
Not used
CVE-2025-52440 2025-06-17 N/A
Not used
CVE-2025-52439 2025-06-17 N/A
Not used
CVE-2025-52438 2025-06-17 N/A
Not used
CVE-2025-52437 2025-06-17 N/A
Not used
CVE-2024-29646 1 Radare 1 Radare2 2025-06-17 9.8 Critical
Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
CVE-2024-35410 1 Kanaka 1 Wac 2025-06-17 6.2 Medium
wac commit 385e1 was discovered to contain a heap overflow via the interpret function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.
CVE-2024-35418 1 Kanaka 1 Wac 2025-06-17 6.2 Medium
wac commit 385e1 was discovered to contain a heap overflow via the setup_call function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.
CVE-2024-35419 1 Kanaka 1 Wac 2025-06-17 5.5 Medium
wac commit 385e1 was discovered to contain a heap overflow via the load_module function at /wac-asan/wa.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted wasm file.
CVE-2024-35420 1 Kanaka 1 Wac 2025-06-17 6.2 Medium
wac commit 385e1 was discovered to contain a heap overflow.
CVE-2024-50648 2 Guchengwuyue, Yshopmall 2 Yshopmall, Yshopmall 2025-06-17 9.8 Critical
yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.
CVE-2024-50649 2 Python Book, Timgreen 2 Python Book, Python Book 2025-06-17 9.8 Critical
The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
CVE-2024-50650 2 Python Book, Timgreen 2 Python Book, Python Book 2025-06-17 7.5 High
python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.