Search

Expected end of text, found '/' (at char 44), (line:1, col:45)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37214 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-5580 1 Codeastro 1 Real Estate Management System 2025-06-04 7.3 High
A vulnerability was found in CodeAstro Real Estate Management System 1.0. It has been classified as critical. This affects an unknown part of the file /login.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-48905 1 Sematell 1 Replyone 2025-06-04 9.1 Critical
Sematell ReplyOne 7.4.3.0 has Insecure Permissions for the /rest/sessions endpoint.
CVE-2024-48906 1 Sematell 1 Replyone 2025-06-04 6.1 Medium
Sematell ReplyOne 7.4.3.0 allows XSS via a ReplyDesk e-mail attachment name.
CVE-2024-48907 1 Sematell 1 Replyone 2025-06-04 7.5 High
Sematell ReplyOne 7.4.3.0 allows SSRF via the application server API.
CVE-2025-45800 1 Totolink 2 A950rg, A950rg Firmware 2025-06-04 9.8 Critical
TOTOLINK A950RG V4.1.2cu.5204_B20210112 contains a command execution vulnerability in the setDeviceName interface of the /lib/cste_modules/global.so library, specifically in the processing of the deviceMac parameter.
CVE-2025-44900 1 Tenda 2 Rx3, Rx3 Firmware 2025-06-04 6.5 Medium
In Tenda RX3 V1.0br_V16.03.13.11 in the GetParentControlInfo function of the web url /goform/GetParentControlInfo, the manipulation of the parameter mac leads to stack overflow.
CVE-2025-44899 1 Tenda 2 Rx3, Rx3 Firmware 2025-06-04 9.8 Critical
There is a stack overflow vulnerability in Tenda RX3 V1.0br_V16.03.13.11 In the fromSetWifiGusetBasic function of the web url /goform/ WifiGuestSet, the manipulation of the parameter shareSpeed leads to stack overflow.
CVE-2024-13244 1 Migrate Tools Project 1 Migrate Tools 2025-06-04 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate Tools allows Cross Site Request Forgery.This issue affects Migrate Tools: from 0.0.0 before 6.0.3.
CVE-2024-10076 1 Automattic 2 Jetpack, Jetpack Boost 2025-06-04 5.9 Medium
The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and above users to perform Stored XSS attacks
CVE-2024-13243 1 Entity Delete Log Project 1 Entity Delete Log 2025-06-04 6.5 Medium
Missing Authorization vulnerability in Drupal Entity Delete Log allows Forceful Browsing.This issue affects Entity Delete Log: from 0.0.0 before 1.1.1.
CVE-2024-13242 1 Swift Mailer Project 1 Swift Mailer 2025-06-04 9.1 Critical
Exposed Dangerous Method or Function vulnerability in Drupal Swift Mailer allows Resource Location Spoofing.This issue affects Swift Mailer: *.*.
CVE-2024-10075 1 Automattic 1 Jetpack 2025-06-04 5.6 Medium
The Jetpack WordPress plugin before 13.8 does not ensure that the post created by the Contact Form is only accessible to authorised users, which could allow unauthenticated users to run arbitrary shortcodes and block.
CVE-2024-13241 1 Getopensocial 1 Open Social 2025-06-04 9.1 Critical
Improper Authorization vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.0.5.
CVE-2024-13240 1 Getopensocial 1 Open Social 2025-06-04 7.5 High
Improper Access Control vulnerability in Drupal Open Social allows Collect Data from Common Resource Locations.This issue affects Open Social: from 0.0.0 before 12.05.
CVE-2024-13239 1 Two-factor Authentication Project 1 Two-factor Authentication 2025-06-04 9.8 Critical
Weak Authentication vulnerability in Drupal Two-factor Authentication (TFA) allows Authentication Abuse.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.5.0.
CVE-2023-5934 1 Travelpayouts 1 Travelpayouts 2025-06-04 7.3 High
The Travelpayouts: All Travel Brands in One Place WordPress plugin before 1.1.13 does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack
CVE-2025-40581 1 Siemens 2 Scalance Lpe9403, Scalance Lpe9403 Firmware 2025-06-04 7.1 High
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices are vulnerable to an authentication bypass. This could allow a non-privileged local attacker to bypass the authentication of the SINEMA Remote Connect Edge Client, and to read and modify the configuration parameters.
CVE-2025-40578 1 Siemens 2 Scalance Lpe9403, Scalance Lpe9403 Firmware 2025-06-04 4.3 Medium
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). Affected devices do not properly handle multiple incoming Profinet packets received in rapid succession. An unauthenticated remote attacker can exploit this flaw by sending multiple packets in a very short time frame, which leads to a crash of the dcpd process.
CVE-2024-13238 1 Typogrify Project 1 Typogrify 2025-06-04 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Typogrify allows Cross-Site Scripting (XSS).This issue affects Typogrify: from 0.0.0 before 1.3.0.
CVE-2024-13237 1 File Entity Project 1 File Entity 2025-06-04 5.4 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal File Entity (fieldable files) allows Cross-Site Scripting (XSS).This issue affects File Entity (fieldable files): from 7.X-* before 7.X-2.38.