Export limit exceeded: 46854 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46854 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-50052 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2025-09-29 | 4.3 Medium |
| Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post. | ||||
| CVE-2024-47401 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2025-09-29 | 4.3 Medium |
| Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1 and 9.5.x <= 9.5.9 fail to prevent detailed error messages from being displayed in Playbooks which allows an attacker to generate a large response and cause an amplified GraphQL response which in turn could cause the application to crash by sending a specially crafted request to Playbooks. | ||||
| CVE-2024-8370 | 1 Grocy Project | 1 Grocy | 2025-09-29 | 3.5 Low |
| A vulnerability classified as problematic was found in Grocy up to 4.2.0. This vulnerability affects unknown code of the file /api/files/recipepictures/ of the component SVG File Upload Handler. The manipulation of the argument force_serve_as with the input picture' leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. Unfortunately, the project maintainer does not want to be quoted in any way regarding the dispute rationale. The security policy of the project implies that this finding is "practically irrelevant" due to authentication requirements. | ||||
| CVE-2024-39914 | 1 Fogproject | 1 Fogproject | 2025-09-29 | 9.8 Critical |
| FOG is a cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.34, packages/web/lib/fog/reportmaker.class.php in FOG was affected by a command injection via the filename parameter to /fog/management/export.php. This vulnerability is fixed in 1.5.10.34. | ||||
| CVE-2025-58443 | 1 Fogproject | 1 Fogproject | 2025-09-29 | 9.1 Critical |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. It is possible for an attacker to perform an unauthenticated DB dump where they could pull a full SQL DB without credentials. A fix is expected to be released 9/15/2025. To address this vulnerability immediately, upgrade to the latest version of either the dev-branch or working-1.6 branch. This will patch the issue for users concerned about immediate exposure. See the FOG Project documentation for step-by-step upgrade instructions: https://docs.fogproject.org/en/latest/install-fog-server#choosing-a-fog-version. | ||||
| CVE-2025-59545 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 9.1 Critical |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0. | ||||
| CVE-2024-9133 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 6.6 Medium |
| A user with administrator privileges is able to retrieve authentication tokens | ||||
| CVE-2024-9132 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 8.1 High |
| The administrator is able to configure an insecure captive portal script | ||||
| CVE-2024-9131 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 7.2 High |
| A user with administrator privileges can perform command injection | ||||
| CVE-2024-47520 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 7.6 High |
| A user with advanced report application access rights can perform actions for which they are not authorized | ||||
| CVE-2024-47519 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 8.3 High |
| Backup uploads to ETM subject to man-in-the-middle interception | ||||
| CVE-2024-47518 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 6.4 Medium |
| Specially constructed queries targeting ETM could discover active remote access sessions | ||||
| CVE-2024-47517 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 6.8 Medium |
| Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access | ||||
| CVE-2024-9188 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 8.8 High |
| Specially constructed queries cause cross platform scripting leaking administrator tokens | ||||
| CVE-2025-4331 | 1 Senior-walter | 1 Online Student Clearance System | 2025-09-27 | 7.3 High |
| A vulnerability classified as critical was found in SourceCodester Online Student Clearance System 1.0. This vulnerability affects unknown code of the file /Admin/login.php. The manipulation of the argument id/username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-4469 | 1 Senior-walter | 1 Online Student Clearance System | 2025-09-27 | 2.4 Low |
| A vulnerability classified as problematic has been found in SourceCodester Online Student Clearance System 1.0. Affected is an unknown function of the file /admin/add-admin.php. The manipulation of the argument txtusername/txtfullname/txtpassword/txtpassword2 leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-9738 | 1 Portabilis | 1 I-educar | 2025-09-27 | 3.5 Low |
| A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_tipo_ensino_cad.php. Executing manipulation of the argument nm_tipo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2025-9760 | 1 Portabilis | 1 I-educar | 2025-09-27 | 6.3 Medium |
| A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /module/Api/matricula of the component Matricula API. Executing manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been made available to the public and could be exploited. | ||||
| CVE-2025-7868 | 1 Portabilis | 1 I-educar | 2025-09-27 | 3.5 Low |
| A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_calendario_dia_motivo_cad.php of the component Calendar Module. The manipulation of the argument Motivo/descricao results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-7867 | 1 Portabilis | 1 I-educar | 2025-09-27 | 3.5 Low |
| A vulnerability has been found in Portabilis i-Educar 2.9.0/2.10.0. This vulnerability affects unknown code of the file /intranet/agenda.php of the component Agenda Module. The manipulation of the argument novo_titulo/novo_descricao leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||