Search

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (37278 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-41785 2 Foxit, Microsoft 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more 2024-11-21 7.8 High
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVE-2021-41784 2 Foxit, Microsoft 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more 2024-11-21 7.8 High
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVE-2021-41783 2 Foxit, Microsoft 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more 2024-11-21 7.8 High
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVE-2021-41782 2 Foxit, Microsoft 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more 2024-11-21 7.8 High
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVE-2021-41781 2 Foxit, Microsoft 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more 2024-11-21 7.8 High
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVE-2021-41780 2 Foxit, Microsoft 4 Pdf Editor, Pdf Reader, Phantompdf and 1 more 2024-11-21 7.8 High
Foxit PDF Reader before 11.1 and PDF Editor before 11.1, and PhantomPDF before 10.1.6, allow attackers to trigger a use-after-free and execute arbitrary code because JavaScript is mishandled.
CVE-2021-41756 1 Dynamicvision 1 Dynamicmarkt 2024-11-21 9.8 Critical
dynamicMarkt <= 3.10 is affected by SQL injection in the kat parameter of index.php.
CVE-2021-41755 1 Dynamicvision 1 Dynamicmarkt 2024-11-21 9.8 Critical
dynamicMarkt <= 3.10 is affected by SQL injection in the kat1 parameter of index.php.
CVE-2021-41754 1 Dynamicvision 1 Dynamicmarkt 2024-11-21 9.8 Critical
dynamicMarkt <= 3.10 is affected by SQL injection in the parent parameter of index.php.
CVE-2021-41751 1 Jerryscript 1 Jerryscript 2024-11-21 9.8 Critical
Buffer overflow vulnerability in file ecma-builtin-array-prototype.c:909 in function ecma_builtin_array_prototype_object_slice in Jerryscript before commit e1ce7dd7271288be8c0c8136eea9107df73a8ce2 on Oct 20, 2021.
CVE-2021-41750 1 Nystudio107 1 Seomatic 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName parameter containing an arbitrary filename with the intended content-type to be rendered in the user's browser as the extension.
CVE-2021-41749 1 Nystudio107 1 Seomatic 2024-11-21 9.8 Critical
In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
CVE-2021-41738 1 Zeroshell 1 Zeroshell 2024-11-21 8.8 High
ZeroShell 3.9.5 has a command injection vulnerability in /cgi-bin/kerbynet IP parameter, which may allow an authenticated attacker to execute system commands.
CVE-2021-41663 1 1234n 1 Minicms 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page.
CVE-2021-41662 1 South Gate Inn Online Reservation System Project 1 South Gate Inn Online Reservation System 2024-11-21 9.8 Critical
The South Gate Inn Online Reservation System v1.0 contains an SQL injection vulnerability that can be chained with a malicious PHP file upload, which is caused by improper file handling in the editImg function. This vulnerability leads to remote code execution.
CVE-2021-41661 1 Church Management System Project 1 Church Management System 2024-11-21 9.8 Critical
Church Management System version 1.0 is affected by a SQL anjection vulnerability through creating a user with a PHP file as an avatar image, which is accessible through the /uploads directory. This can lead to RCE on the web server by uploading a PHP webshell.
CVE-2021-41615 1 Embedthis 1 Goahead 2024-11-21 9.8 Critical
websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparadise value, which does not follow the secret-data guideline for HTTP Digest Access Authentication in RFC 7616 section 3.3 (or RFC 2617 section 3.2.1). NOTE: 2.1.8 is a version from 2003; however, the affected websda.c code appears in multiple derivative works that may be used in 2021. Recent GoAhead software is unaffected.
CVE-2021-41568 1 Tad Web Project 1 Tad Web 2024-11-21 5.3 Medium
Tad Web is vulnerable to authorization bypass, thus remote attackers can exploit the vulnerability to use the original function of viewing bulletin boards and uploading files in the system.
CVE-2021-41567 1 Tad Uploader Project 1 Tad Uploader 2024-11-21 6.1 Medium
The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.
CVE-2021-41566 1 Tadtools Project 1 Tadtools 2024-11-21 9.8 Critical
The file extension of the TadTools file upload function fails to filter, thus remote attackers can upload any types of files and execute arbitrary code without logging in.