Search

Expected end of text, found '/' (at char 44), (line:1, col:45)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (363233 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-47117 1 Humansignal 1 Label Studio 2025-01-08 7.5 High
Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set filters for filtering tasks. An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper (ORM). Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by character. In addition, Label Studio had a hard coded secret key that an attacker can use to forge a session token of any user by exploiting this ORM Leak vulnerability to leak account password hashes. This vulnerability has been addressed in commit `f931d9d129` which is included in the 1.9.2post0 release. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-47697 1 Wp-eventmanager 1 Wp Event Manager 2025-01-08 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin <= 3.1.39 versions.
CVE-2023-47696 1 Gravitymaster 1 Product Enquiry For Woocommerce 2025-01-08 7.1 High
Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions.
CVE-2023-47695 1 Scribit 1 Shortcodes Finder 2025-01-08 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Shortcodes Finder plugin <= 1.5.3 versions.
CVE-2023-47690 1 Antonbond 1 Additional Order Filters For Woocommerce 2025-01-08 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Anton Bond Additional Order Filters for WooCommerce plugin <= 1.10 versions.
CVE-2023-47684 1 Themepunch 1 Essential Grid 2025-01-08 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions.
CVE-2023-47680 1 Qodeinteractive 1 Qi Addons For Elementor 2025-01-08 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Qode Interactive Qi Addons For Elementor plugin <= 1.6.3 versions.
CVE-2023-47673 1 Thecrowned 1 Post Pay Counter 2025-01-08 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Stefano Ottolenghi Post Pay Counter plugin <= 2.784 versions.
CVE-2023-47665 1 Plainviewplugins 1 Plainview Protect Passwords 2025-01-08 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in edward_plainview Plainview Protect Passwords plugin <= 1.4 versions.
CVE-2023-34339 1 Jetbrains 1 Ktor 2025-01-08 3.3 Low
In JetBrains Ktor before 2.3.1 headers containing authentication data could be added to the exception's message
CVE-2023-47662 1 Goldbroker 1 Live Gold Price \& Silver Price Charts Widgets 2025-01-08 5.9 Medium
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GoldBroker.Com Live Gold Price & Silver Price Charts Widgets plugin <= 2.4 versions.
CVE-2023-47710 1 Ibm 1 Security Guardium 2025-01-08 5.4 Medium
IBM Security Guardium 11.4, 11.5, and 12.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 271525.
CVE-2023-34408 1 Dokuwiki 1 Dokuwiki 2025-01-08 5.4 Medium
DokuWiki before 2023-04-04a allows XSS via RSS titles.
CVE-2023-33763 1 Simpleredak 1 Simpleredak 2025-01-08 6.1 Medium
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.
CVE-2023-33762 1 Simpleredak 1 Simpleredak 2025-01-08 9.8 Critical
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a SQL injection vulnerability via the Activity parameter.
CVE-2023-33761 1 Simpleredak 1 Simpleredak 2025-01-08 6.1 Medium
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php.
CVE-2023-33731 1 Escanav 1 Escan Management Console 2025-01-08 6.1 Medium
Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly.
CVE-2023-33408 1 Minical 1 Minical 2025-01-08 5.4 Medium
Minical 1.0.0 is vulnerable to Cross Site Scripting (XSS). The vulnerability exists due to insufficient input validation in the application's user input handling in the security_helper.php file.
CVE-2023-33386 1 Marsctf Project 1 Marsctf 2025-01-08 9.8 Critical
MarsCTF 1.2.1 has an arbitrary file upload vulnerability in the interface for uploading attachments in the background.
CVE-2020-19028 1 Emlog 1 Emlog 2025-01-08 7.5 High
*File Upload vulnerability found in Emlog EmlogCMS v.6.0.0 allows a remote attacker to gain access to sensitive information via the /admin/plugin.php function.