Export limit exceeded: 365306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365306 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-27794 | 1 Flarum | 1 Flarum | 2025-04-02 | 6.8 Medium |
| Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain under a parent domain (e.g., `subdomain.host.com`) sets cookies scoped to the parent domain (`.host.com`). This allows session token replacement for applications hosted on sibling subdomains (e.g., `community.host.com`) if session tokens aren't rotated post-authentication. Key Constraints are that the attacker must control any subdomain under the parent domain (e.g., `evil.host.com` or `x.y.host.com`), and the parent domain must not be on the Public Suffix List. Due to non-existent session token rotation after authenticating we can theoretically reproduce the vulnerability by using browser dev tools, but due to the browser's security measures this does not seem to be exploitable as described. Version 1.8.10 contains a patch for the issue. | ||||
| CVE-2025-1619 | 1 Mooveagency | 1 Gdpr Cookie Compliance | 2025-04-02 | 4.8 Medium |
| The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-1620 | 1 Mooveagency | 1 Gdpr Cookie Compliance | 2025-04-02 | 4.8 Medium |
| The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-1621 | 1 Mooveagency | 1 Gdpr Cookie Compliance | 2025-04-02 | 4.8 Medium |
| The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-2646 | 1 Phpgurukul | 1 Art Gallery Management System | 2025-04-02 | 7.3 High |
| A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument contactnumber leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. | ||||
| CVE-2025-1622 | 1 Mooveagency | 1 Gdpr Cookie Compliance | 2025-04-02 | 3.5 Low |
| The GDPR Cookie Compliance WordPress plugin before 4.15.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-1623 | 1 Mooveagency | 1 Gdpr Cookie Compliance | 2025-04-02 | 3.5 Low |
| The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-1624 | 1 Mooveagency | 1 Gdpr Cookie Compliance | 2025-04-02 | 3.5 Low |
| The GDPR Cookie Compliance WordPress plugin before 4.15.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-2378 | 1 Phpgurukul | 1 Medical Card System | 2025-04-02 | 7.3 High |
| A vulnerability was found in PHPGurukul Medical Card Generation System 1.0. It has been classified as critical. This affects an unknown part of the file /download-medical-cards.php. The manipulation of the argument searchdata leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-29431 | 1 Code-projects | 1 Online Class And Exam Scheduling System | 2025-04-02 | 3.2 Low |
| Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/department.php via the id, code, and name parameters. | ||||
| CVE-2025-2390 | 1 Code-projects | 1 Blood Bank Management System | 2025-04-02 | 6.3 Medium |
| A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. This affects an unknown part of the file /user_dashboard/add_donor.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2025-29426 | 1 Code-projects | 1 Online Class And Exam Scheduling System | 2025-04-02 | 4.6 Medium |
| Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting (XSS) in /pages/class.php via the id and cys parameters. | ||||
| CVE-2025-2393 | 1 Code-projects | 1 Online Class And Exam Scheduling System | 2025-04-02 | 4.7 Medium |
| A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of the file /pages/salut_del.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-44313 | 1 Tastyigniter | 1 Tastyigniter | 2025-04-02 | 8.1 High |
| TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks. | ||||
| CVE-2024-44314 | 1 Tastyigniter | 1 Tastyigniter | 2025-04-02 | 6.5 Medium |
| TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the Orders Management System, allowing unauthorized users to update order statuses. The issue occurs in the index_onUpdateStatus() function within Orders.php, which fails to verify if the user has permission to modify an order's status. This flaw can be exploited remotely, leading to unauthorized order manipulation. | ||||
| CVE-2024-57169 | 1 Soplanning | 1 Soplanning | 2025-04-02 | 9.8 Critical |
| A file upload bypass vulnerability exists in SOPlanning 1.53.00, specifically in /process/upload.php. This vulnerability allows remote attackers to bypass upload restrictions and potentially achieve remote code execution by uploading malicious files. | ||||
| CVE-2024-57170 | 1 Soplanning | 1 Soplanning | 2025-04-02 | 6.5 Medium |
| SOPlanning 1.53.00 is vulnerable to a directory traversal issue in /process/upload.php. The "fichier_to_delete" parameter allows authenticated attackers to specify file paths containing directory traversal sequences (e.g., ../). This vulnerability enables attackers to delete arbitrary files outside the intended upload directory, potentially leading to denial of service or disruption of application functionality. | ||||
| CVE-2025-25582 | 1 R1bbit | 1 Yimioa | 2025-04-02 | 6.1 Medium |
| yimioa before v2024.07.04 was discovered to contain a SQL injection vulnerability via the selectNoticeList() method at /xml/OaNoticeMapper.xml. | ||||
| CVE-2024-20440 | 1 Cisco | 2 Cisco Smart License Utility, Smart License Utility | 2025-04-01 | 7.5 High |
| A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to obtain log files that contain sensitive data, including credentials that can be used to access the API. | ||||
| CVE-2020-36657 | 1 Uptimed Project | 1 Uptimed | 2025-04-01 | 7.8 High |
| uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard link within the /var/spool/uptimed directory, because there is an unsafe chown -R call. | ||||