Search

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43134 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-46709 1 Phpliteadmin 1 Phpliteadmin 2024-11-21 6.1 Medium
phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).
CVE-2021-46705 3 Gnu, Opensuse, Suse 3 Grub2, Factory, Linux Enterprise Server 2024-11-21 5.1 Medium
A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.
CVE-2021-46457 1 Dlink 2 Dir-823 Pro, Dir-823 Pro Firmware 2024-11-21 9.8 Critical
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function ChgSambaUserSettings. This vulnerability allows attackers to execute arbitrary commands via the samba_name parameter.
CVE-2021-46456 1 Dlink 2 Dir-823 Pro, Dir-823 Pro Firmware 2024-11-21 9.8 Critical
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl(0).(0)_maclist parameter.
CVE-2021-46455 1 Dlink 2 Dir-823 Pro, Dir-823 Pro Firmware 2024-11-21 9.8 Critical
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStationSettings. This vulnerability allows attackers to execute arbitrary commands via the station_access_enable parameter.
CVE-2021-46454 1 Dlink 2 Dir-823 Pro, Dir-823 Pro Firmware 2024-11-21 9.8 Critical
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanApcliSettings. This vulnerability allows attackers to execute arbitrary commands via the ApCliKeyStr parameter.
CVE-2021-46453 1 Dlink 2 Dir-823 Pro, Dir-823 Pro Firmware 2024-11-21 9.8 Critical
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetStaticRouteSettings. This vulnerability allows attackers to execute arbitrary commands via the staticroute_list parameter.
CVE-2021-46452 1 Dlink 2 Dir-823 Pro, Dir-823 Pro Firmware 2024-11-21 9.8 Critical
D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via the tomography_ping_address, tomography_ping_number, tomography_ping_size, tomography_ping_timeout, and tomography_ping_ttl parameters.
CVE-2021-46229 1 Dlink 2 Di-7200gv2, Di-7200gv2 Firmware 2024-11-21 9.8 Critical
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter.
CVE-2021-45966 1 Pascom 1 Cloud Phone System 2024-11-21 9.8 Critical
An issue was discovered in Pascom Cloud Phone System before 7.20.x. In the management REST API, /services/apply in exd.pl allows remote attackers to execute arbitrary code via shell metacharacters.
CVE-2021-45892 1 Zauner 1 Arc 2024-11-21 5.9 Medium
An issue was discovered in Softwarebuero Zauner ARC 4.2.0.4. There is storage of Passwords in a Recoverable Format.
CVE-2021-45889 1 Ponton 1 X\/p Messenger 2024-11-21 5.4 Medium
An issue was discovered in PONTON X/P Messenger before 3.11.2. Several functions are vulnerable to reflected XSS, as demonstrated by private/index.jsp?partners/ShowNonLocalPartners.do?localID= or private/index.jsp or private/index.jsp?database/databaseTab.jsp or private/index.jsp?activation/activationMainTab.jsp or private/index.jsp?communication/serverTab.jsp or private/index.jsp?emailNotification/notificationTab.jsp.
CVE-2021-45888 1 Ponton 1 X\/p Messenger 2024-11-21 4.8 Medium
An issue was discovered in PONTON X/P Messenger before 3.11.2. The navigation tree that is shown on the left side of every page of the web application is vulnerable to XSS: it allows injection of JavaScript into its nodes. Creating such nodes is only possible for users who have the role Configuration Administrator or Administrator.
CVE-2021-45887 1 Ponton 1 X\/p Messenger 2024-11-21 9.8 Critical
An issue was discovered in PONTON X/P Messenger before 3.11.2. Due to path traversal in private/SchemaSetUpload.do for uploaded ZIP files, an executable script can be uploaded by web application administrators, giving the attacker remote code execution on the underlying server via an imgs/*.jsp URI.
CVE-2021-45886 1 Ponton 1 X\/p Messenger 2024-11-21 8.8 High
An issue was discovered in PONTON X/P Messenger before 3.11.2. Anti-CSRF tokens are globally valid, making the web application vulnerable to a weakened version of CSRF, where an arbitrary token of a low-privileged user (such as operator) can be used to confirm actions of higher-privileged ones (such as xpadmin).
CVE-2021-45852 1 Projectworlds 1 Hospital Management System In Php 2024-11-21 5.3 Medium
An issue was discovered in Projectworlds Hospital Management System v1.0. Unauthorized malicious attackers can add patients without restriction via add_patient.php.
CVE-2021-45851 1 Frangoteam 1 Fuxa 2024-11-21 7.5 High
A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
CVE-2021-45848 2 Fedoraproject, Nicotine-plus 2 Fedora, Nicotine\+ 2024-11-21 7.5 High
Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
CVE-2021-45835 1 Online Admission System Project 1 Online Admissions System 2024-11-21 9.8 Critical
The Online Admission System 1.0 allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through documents.php, which may be used to execute malicious code or lead to code execution.
CVE-2021-45834 1 Opendocman 1 Opendocman 2024-11-21 9.8 Critical
An attacker can upload or transfer files of dangerous types to the OpenDocMan 1.4.4 portal via add.php using MIME-bypass, which may be automatically processed within the product's environment or lead to arbitrary code execution.