Search

Expected end of text, found '\' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (395094 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-19555 1 Tp4a 1 Teleport 2024-11-21 N/A
tp4a TELEPORT 3.1.0 has CSRF via user/do-reset-password to change any password, such as the administrator password.
CVE-2018-19554 1 Dotcms 1 Dotcms 2024-11-21 N/A
An issue was discovered in Dotcms through 5.0.3. Attackers may perform XSS attacks via the inode, identifier, or fieldName parameter in html/js/dotcms/dijit/image/image_tool.jsp.
CVE-2018-19553 1 Interspire 1 Email Marketer 2024-11-21 N/A
Interspire Email Marketer through 6.1.6 has SQL Injection via an updateblock sortorder request to Dynamiccontenttags.php
CVE-2018-19552 1 Interspire 1 Email Marketer 2024-11-21 N/A
Interspire Email Marketer through 6.1.6 has SQL Injection via a deleteblock blockid[] request to Dynamiccontenttags.php.
CVE-2018-19551 1 Interspire 1 Email Marketer 2024-11-21 N/A
Interspire Email Marketer through 6.1.6 has SQL Injection via a checkduplicatetags tagname request to Dynamiccontenttags.php.
CVE-2018-19550 1 Interspire 1 Email Marketer 2024-11-21 N/A
Interspire Email Marketer through 6.1.6 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a admin/temp/surveys/ URI.
CVE-2018-19549 1 Interspire 1 Email Marketer 2024-11-21 N/A
Interspire Email Marketer through 6.1.6 has SQL Injection via a tagids Delete action to Dynamiccontenttags.php.
CVE-2018-19548 1 Rudrasoftech 1 Edusec 2024-11-21 N/A
index.php?r=site%2Flogin in EduSec through 4.2.6 does not restrict sending a series of LoginForm[username] and LoginForm[password] parameters, which might make it easier for remote attackers to obtain access via a brute-force approach.
CVE-2018-19547 1 Jtbc 1 Jtbc Php 2024-11-21 N/A
JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.
CVE-2018-19546 1 Jtbc 1 Jtbc Php 2024-11-21 N/A
JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter.
CVE-2018-19545 1 Jeecms 1 Jeecms 2024-11-21 N/A
JEECMS 9.3 has CSRF via the api/admin/role/save URI to add a user.
CVE-2018-19544 1 Jeecms 1 Jeecms 2024-11-21 N/A
JEECMS 9.3 has CSRF via the api/admin/content/save URI to add news.
CVE-2018-19537 1 Tp-link 2 Archer C5, Archer C5 Firmware 2024-11-21 N/A
TP-Link Archer C5 devices through V2_160201_US allow remote command execution via shell metacharacters on the wan_dyn_hostname line of a configuration file that is encrypted with the 478DA50BF9E3D2CF key and uploaded through the web GUI by using the web admin account. The default password of admin may be used in some cases.
CVE-2018-19535 4 Canonical, Debian, Exiv2 and 1 more 7 Ubuntu Linux, Debian Linux, Exiv2 and 4 more 2024-11-21 6.5 Medium
In Exiv2 0.26 and previous versions, PngChunk::readRawProfile in pngchunk_int.cpp may cause a denial of service (application crash due to a heap-based buffer over-read) via a crafted PNG file.
CVE-2018-19532 1 Podofo Project 1 Podofo 2024-11-21 N/A
A NULL pointer dereference vulnerability exists in the function PdfTranslator::setTarget() in pdftranslator.cpp of PoDoFo 0.9.6, while creating the PdfXObject, as demonstrated by podofoimpose. It allows an attacker to cause Denial of Service.
CVE-2018-19531 1 Httl Project 1 Httl 2024-11-21 N/A
HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses java.beans.XMLEncoder unsafely when configured without an xml.codec= setting.
CVE-2018-19530 1 Httl Project 1 Httl 2024-11-21 N/A
HTTL (aka Hyper-Text Template Language) through 1.0.11 allows remote command execution because the decodeXml function uses XStream unsafely when configured with an xml.codec=httl.spi.codecs.XstreamCodec setting.
CVE-2018-19528 1 Tp-link 2 Tl-wr886n, Tl-wr886n Firmware 2024-11-21 N/A
TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port 53/udp.
CVE-2018-19527 1 I4 1 Ai Si Assistant 2024-11-21 N/A
i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.
CVE-2018-19525 1 Systrome 6 Cumilon Isg-600c, Cumilon Isg-600c Firmware, Cumilon Isg-600h and 3 more 2024-11-21 N/A
An issue was discovered on Systrome ISG-600C, ISG-600H, and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validation.