Export limit exceeded: 365286 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 365286 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365286 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-27476 | 1 Leantime | 1 Leantime | 2025-04-08 | 4.7 Medium |
| Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show#/tickets/newTicket. | ||||
| CVE-2024-27477 | 1 Leantime | 1 Leantime | 2025-04-08 | 6.1 Medium |
| In Leantime 3.0.6, a Cross-Site Scripting vulnerability exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets (also known as to-dos). This stored XSS vulnerability can be exploited to perform Server-Side Request Forgery (SSRF) attacks. | ||||
| CVE-2024-22722 | 1 Formtools | 1 Form Tools | 2025-04-08 | 7.2 High |
| Server Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application. | ||||
| CVE-2024-22721 | 1 Formtools | 1 Form Tools | 2025-04-08 | 6.3 Medium |
| Cross Site Request Forgery (CSRF) vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link. | ||||
| CVE-2024-22719 | 1 Formtools | 1 Form Tools | 2025-04-08 | 8.1 High |
| SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client. | ||||
| CVE-2024-22718 | 1 Formtools | 1 Form Tools | 2025-04-08 | 9.6 Critical |
| Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the client_id parameter in the application URL. | ||||
| CVE-2024-22717 | 1 Formtools | 1 Form Tools | 2025-04-08 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary code via the First Name field in the application. | ||||
| CVE-2024-31678 | 2 Loan Management System Project, Razormist | 2 Loan Management System, Loan Management System | 2025-04-08 | 9.8 Critical |
| Sourcecodester Loan Management System v1.0 is vulnerable to SQL Injection via the "password" parameter in the "login.php" file. | ||||
| CVE-2024-29220 | 1 Ninjaforms | 1 Ninja Forms | 2025-04-08 | 6.1 Medium |
| Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. | ||||
| CVE-2024-26019 | 1 Ninjaforms | 1 Ninja Forms | 2025-04-08 | 5.4 Medium |
| Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. | ||||
| CVE-2024-25572 | 2 Ninjaforms, Saturday Drive | 2 Ninja Forms, Ninja Forms | 2025-04-08 | 8.8 High |
| Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. | ||||
| CVE-2022-46623 | 1 Judging Management System Project | 1 Judging Management System | 2025-04-08 | 7.8 High |
| Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter. | ||||
| CVE-2022-46622 | 1 Judging Management System Project | 1 Judging Management System | 2025-04-08 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter. | ||||
| CVE-2022-46503 | 1 Online Student Enrollment System Project | 1 Online Student Enrollment System | 2025-04-08 | 5.4 Medium |
| A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter. | ||||
| CVE-2022-46472 | 1 Helmet Store Showroom Site Project | 1 Helmet Store Showroom Site | 2025-04-08 | 7.2 High |
| Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete. | ||||
| CVE-2022-46370 | 1 Maxum | 1 Rumpus | 2025-04-08 | 7.3 High |
| Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification. | ||||
| CVE-2022-3628 | 2 Linux, Redhat | 4 Linux Kernel, Enterprise Linux, Rhel Eus and 1 more | 2025-04-08 | 6.6 Medium |
| A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges. | ||||
| CVE-2022-25027 | 1 Rocketsoftware | 1 Trufusion Enterprise | 2025-04-08 | 7.5 High |
| The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by validating the user's session token when the "Password forgotten?" button is clicked. | ||||
| CVE-2022-25026 | 1 Rocketsoftware | 1 Trufusion Enterprise | 2025-04-08 | 7.5 High |
| A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network via a crafted HTTP request to /trufusionPortal/upDwModuleProxy. | ||||
| CVE-2017-5242 | 1 Rapid7 | 1 Insightvm | 2025-04-08 | 7.7 High |
| Nexpose and InsightVM virtual appliances downloaded between April 5th, 2017 and May 3rd, 2017 contain identical SSH host keys. Normally, a unique SSH host key should be generated the first time a virtual appliance boots. | ||||