Search

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (29373 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-44796 2 Picuploader Project, Xiebruce 2 Picuploader, Picuploader 2024-09-06 8 High
A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
CVE-2024-44797 1 Gazelle Project 1 Gazelle 2024-09-06 5.4 Medium
A cross-site scripting (XSS) vulnerability in the component /managers/enable_requests.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the view parameter.
CVE-2024-8181 1 Flowiseai 1 Flowise 2024-09-06 9.8 Critical
An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality.
CVE-2024-42790 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2024-09-05 6.1 Medium
A Reflected Cross Site Scripting (XSS) vulnerability was found in "/music/index.php?page=test" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via the "page" parameter.
CVE-2024-42792 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2024-09-05 3.5 Low
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_playlist page.
CVE-2024-42906 2 Jenkins, Testlink 2 Testlink, Testlink 2024-09-05 4.1 Medium
TestLink before v.1.9.20 is vulnerable to Cross Site Scripting (XSS) via the pop-up on upload file. When uploading a file, the XSS payload can be entered into the file name.
CVE-2024-44793 1 Gazelle Project 1 Gazelle 2024-09-05 6.1 Medium
A cross-site scripting (XSS) vulnerability in the component /managers/multiple_freeleech.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the torrents parameter.
CVE-2024-44794 2 Picuploader, Xiebruce 2 Commit, Picuploader 2024-09-05 6.1 Medium
A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.
CVE-2024-44795 1 Gazelle Project 1 Gazelle 2024-09-05 6.1 Medium
A cross-site scripting (XSS) vulnerability in the component /login/disabled.php of Gazelle commit 63b3370 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter.
CVE-2024-38869 1 Zohocorp 4 Manageengine Endpoint Central, Manageengine Servicedesk Plus, Manageengine Servicedesk Plus Msp and 1 more 2024-08-30 8.3 High
Zohocorp ManageEngine Endpoint Central affected by Incorrect authorization vulnerability in remote office deploy configurations.This issue affects Endpoint Central: before 11.3.2416.04 and before 11.3.2400.25.
CVE-2024-45436 1 Ollama 1 Ollama 2024-08-30 9.1 Critical
extractFromZipFile in model.go in Ollama before 0.1.47 can extract members of a ZIP archive outside of the parent directory.
CVE-2022-39996 1 Teldat 4 Rs123, Rs123 Firmware, Rs123w and 1 more 2024-08-30 4.8 Medium
Cross Site Scripting vulnerability in Teldats Router RS123, RS123w allows attacker to execute arbitrary code via the cmdcookie parameter to the upgrade/query.php page.
CVE-2024-45264 2 Skyss, Skysystem 2 Arfa-cms, Arfa Cms 2024-08-30 8 High
A cross-site request forgery (CSRF) vulnerability in the admin panel in SkySystem Arfa-CMS before 5.1.3124 allows remote attackers to add a new administrator, leading to escalation of privileges.
CVE-2024-43915 1 Zephyr-one 1 Zephyr Project Manager 2024-08-28 5.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dylan James Zephyr Project Manager allows Reflected XSS.This issue affects Zephyr Project Manager: from n/a through .3.102.
CVE-2024-7940 1 Hitachienergy 1 Microscada X Sys600 2024-08-28 8.3 High
The product exposes a service that is intended for local only to all network interfaces without any authentication.
CVE-2024-8172 2 Rems, Sourcecodester 2 Qr Code Attendance System, Qr Code Attendance System 2024-08-28 3.5 Low
A vulnerability, which was classified as problematic, has been found in SourceCodester QR Code Attendance System 1.0. This issue affects some unknown processing of the file /endpoint/delete-student.php. The manipulation of the argument student/attendance leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-8170 2 Rems, Sourcecodester 2 Zipped Folder Manager App, Zipped Folder Manager App 2024-08-27 3.5 Low
A vulnerability classified as problematic has been found in SourceCodester Zipped Folder Manager App 1.0. This affects an unknown part of the file /endpoint/add-folder.php. The manipulation of the argument folder leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-43337 1 Getbrave 1 Brave 2024-08-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Brave Brave Popup Builder.This issue affects Brave Popup Builder: from n/a through 0.7.0.
CVE-2024-43339 1 Webinarpress 1 Webinarpress 2024-08-27 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in WebinarPress allows Cross-Site Scripting (XSS).This issue affects WebinarPress: from n/a through 1.33.20.
CVE-2024-43340 1 Advancedformintegration 1 Advanced Form Integration 2024-08-27 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Nasirahmed Advanced Form Integration.This issue affects Advanced Form Integration: from n/a through 1.89.4.