Search

Expected end of text, found '‑' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29123 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-8851 1 Codepeople 1 Polls Cp 2025-06-04 5.4 Medium
The Polls CP WordPress plugin before 1.0.77 does not sanitise and escape some of its poll settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multi site setup).
CVE-2023-5932 1 Travelpayouts 1 Travelpayouts 2025-06-04 4.8 Medium
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.14 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-13250 1 Drupal Symfony Mailer Lite Project 1 Drupal Symfony Mailer Lite 2025-06-04 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Drupal Symfony Mailer Lite allows Cross Site Request Forgery.This issue affects Drupal Symfony Mailer Lite: from 0.0.0 before 1.0.6.
CVE-2023-5529 1 Pagevisitcounter 1 Advanced Page Visit Counter 2025-06-04 4.8 Medium
The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2025-3742 1 Dfactory 1 Responsive Lightbox 2025-06-04 6.8 Medium
The Responsive Lightbox & Gallery WordPress plugin before 2.5.1 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2024-13255 1 Restful Web Services Project 1 Restful Web Services 2025-06-04 7.5 High
Exposure of Sensitive Information Through Data Queries vulnerability in Drupal RESTful Web Services allows Forceful Browsing.This issue affects RESTful Web Services: from 7.X-2.0 before 7.X-2.10.
CVE-2024-23731 1 Embedchain 1 Embedchain 2025-06-04 9.8 Critical
The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argument.
CVE-2024-13254 1 Rest Views Project 1 Rest Views 2025-06-04 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal REST Views allows Forceful Browsing.This issue affects REST Views: from 0.0.0 before 3.0.1.
CVE-2024-13252 1 Tacjs Project 1 Tacjs 2025-06-04 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal TacJS allows Cross-Site Scripting (XSS).This issue affects TacJS: from 0.0.0 before 6.5.0.
CVE-2024-13253 1 Advanced Pwa Inc Push Notifications Project 1 Advanced Pwa Inc Push Notifications 2025-06-04 9.1 Critical
Incorrect Authorization vulnerability in Drupal Advanced PWA inc Push Notifications allows Forceful Browsing.This issue affects Advanced PWA inc Push Notifications: from 0.0.0 before 1.5.0.
CVE-2024-13251 1 Registration Role Project 1 Registration Role 2025-06-04 8.8 High
Incorrect Privilege Assignment vulnerability in Drupal Registration role allows Privilege Escalation.This issue affects Registration role: from 0.0.0 before 2.0.1.
CVE-2024-13249 1 Node Access Rebuild Progressive Project 1 Node Access Rebuild Progressive 2025-06-04 5.4 Medium
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 7.X-1.0 before 7.X-1.2.
CVE-2024-13248 1 Private Content Project 1 Private Content 2025-06-04 5.5 Medium
Incorrect Privilege Assignment vulnerability in Drupal Private content allows Target Influence via Framing.This issue affects Private content: from 0.0.0 before 2.1.0.
CVE-2024-13247 1 Coffee Project 1 Coffee 2025-06-04 4.8 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Coffee allows Cross-Site Scripting (XSS).This issue affects Coffee: from 0.0.0 before 1.4.0.
CVE-2024-13246 1 Node Access Rebuild Progressive Project 1 Node Access Rebuild Progressive 2025-06-04 5.3 Medium
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
CVE-2024-13260 1 Migrate Queue Importer Project 1 Migrate Queue Importer 2025-06-04 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.
CVE-2024-13259 1 Image Sizes Project 1 Image Sizes 2025-06-04 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
CVE-2024-13258 1 Rest \& Json Api Authentication Project 1 Rest \& Json Api Authentication 2025-06-04 9.8 Critical
Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
CVE-2024-13257 1 Commerce View Receipt Project 1 Commerce View Receipt 2025-06-04 5.3 Medium
Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
CVE-2024-13256 1 Email Contact Project 1 Email Contact 2025-06-04 7.5 High
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.