Search

Expected end of text, found 'ébec' (at char 15), (line:1, col:16)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (366269 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-21180 1 Oracle 1 Peoplesoft Enterprise Peopletools 2025-03-13 4.1 Medium
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: OpenSearch Dashboards). Supported versions that are affected are 8.59, 8.60 and 8.61. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in PeopleSoft Enterprise PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 4.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N).
CVE-2024-38295 1 Alcasar 1 Alcasar 2025-03-13 8.8 High
ALCASAR before 3.6.1 allows still_connected.php remote code execution.
CVE-2024-38294 1 Alcasar 1 Alcasar 2025-03-13 8.8 High
ALCASAR before 3.6.1 allows email_registration_back.php remote code execution.
CVE-2024-2625 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-13 8.8 High
Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-52723 1 Totolink 2 X6000r, X6000r Firmware 2025-03-13 9.8 Critical
In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
CVE-2024-4381 1 Wielebenwir 1 Commonsbooking 2025-03-13 4.8 Medium
The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-46958 2 Linux, Nextcloud 2 Linux Kernel, Desktop 2025-03-13 9.1 Critical
In Nextcloud Desktop Client 3.13.1 through 3.13.3 on Linux, synchronized files (between the server and client) may become world writable or world readable. This is fixed in 3.13.4.
CVE-2024-46557 1 Draytek 2 Vigor3910, Vigor3910 Firmware 2025-03-13 7.5 High
Draytek Vigor 3910 v4.3.2.6 was discovered to contain a buffer overflow in the sProfileName parameter at v2x00.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2024-44819 1 Zzcms 1 Zzcms 2025-03-13 6.1 Medium
Cross Site Scripting vulnerability in ZZCMS v.2023 and before allows a remote attacker to obtain sensitive information via a crafted script to the pagename parameter of the admin/del.php component.
CVE-2024-40039 1 Idccms Project 1 Idccms 2025-03-13 8.8 High
idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del
CVE-2024-3516 2 Fedoraproject, Google 2 Fedora, Chrome 2025-03-13 8.8 High
Heap buffer overflow in ANGLE in Google Chrome prior to 123.0.6312.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-37768 1 B1ackc4t 1 14finger 2025-03-13 9.1 Critical
14Finger v1.1 was discovered to contain an arbitrary user deletion vulnerability via the component /api/admin/user?id.
CVE-2024-37632 1 Totolink 2 A3700r, A3700r Firmware 2025-03-13 6.5 Medium
TOTOLINK A3700R V9.1.2u.6165_20211012 was discovered to contain a stack overflow via the password parameter in function loginAuth .
CVE-2024-33764 1 Sammycage 1 Lunasvg 2025-03-13 5.5 Medium
lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.
CVE-2024-32504 1 Samsung 16 Exynos 1080, Exynos 1080 Firmware, Exynos 1280 and 13 more 2025-03-13 8.4 High
An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 850, Exynos 1080, Exynos 2100, Exynos 1280, Exynos 1380, Exynos 1330, Exynos W920, Exynos W930. The mobile processor lacks proper length checking, which can result in an OOB (Out-of-Bounds) Write vulnerability.
CVE-2024-31847 1 Italtel 1 Embrace 2025-03-13 6.1 Medium
An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting (XSS) vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization.
CVE-2024-31611 1 Seacms 1 Seacms 2025-03-13 9.1 Critical
SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
CVE-2024-29472 1 Zhyd 1 Oneblog 2025-03-13 5.4 Medium
OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module.
CVE-2024-29318 1 Personal-management-system 1 Personal Management System 2025-03-13 5.4 Medium
Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code.
CVE-2024-28761 1 Ibm 1 App Connect Enterprise 2025-03-13 5.4 Medium
IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 285245.