Search

Expected end of text, found '/' (at char 36), (line:1, col:37)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (16030 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-44844 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44843 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44842 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44841 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44840 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44839 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44838 1 Totolink 2 Cp900, Cp900 Firmware 2025-05-22 6.3 Medium
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44837 1 Totolink 2 Cp900, Cp900 Firmware 2025-05-22 6.3 Medium
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url or magicid parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44836 1 Totolink 2 Cp900, Cp900 Firmware 2025-05-22 6.3 Medium
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setApRebootScheCfg function via the hour or minute parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44848 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-21 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44860 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-05-21 6.5 Medium
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44861 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-05-21 6.3 Medium
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44862 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-05-21 6.3 Medium
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44863 1 Totolink 2 Ca300-poe, Ca300-poe Firmware 2025-05-21 6.5 Medium
TOTOLINK CA300-POE V6.2c.884_B20180522 was found to contain a command injection vulnerability in the msg_process function via the Url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-2054 1 Code-projects 1 Blood Bank Management System 2025-05-21 4.7 Medium
A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/edit_state.php. The manipulation of the argument state_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-2059 1 Phpgurukul 1 Emergency Ambulance Hiring Portal 2025-05-21 7.3 High
A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/booking-details.php. The manipulation of the argument ambulanceregnum leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-2060 1 Phpgurukul 1 Emergency Ambulance Hiring Portal 2025-05-21 7.3 High
A vulnerability was found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. It has been classified as critical. This affects an unknown part of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4873 1 Phpgurukul 1 News Portal 2025-05-21 7.3 High
A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/index.php of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-13668 1 Erwinwolff 1 Wordpress Activity-o-meter 2025-05-21 7.1 High
The WordPress Activity O Meter WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admins.
CVE-2024-13868 1 Tahminajannat 1 Url Shortener \| Conversion Tracking \| Ab Testing \| Woocommerce 2025-05-21 6.1 Medium
The URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin through 9.0.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.