Export limit exceeded: 367714 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (367714 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-35551 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 4.3 Medium |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=add. | ||||
| CVE-2024-35552 | 1 Idccms | 1 Idccms | 2025-04-09 | 8.8 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=del&dataType=logo&dataTypeCN. | ||||
| CVE-2024-35553 | 1 Idccms | 1 Idccms | 2025-04-09 | 8.3 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=add&nohrefStr=close. | ||||
| CVE-2024-35554 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 5.4 Medium |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoWeb_deal.php?mudi=del&dataType=newsWeb&dataTypeCN. | ||||
| CVE-2024-35555 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 6.3 Medium |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/share_switch.php?mudi=switch&dataType=newsWeb&fieldName=state&fieldName2=state&tabName=infoWeb&dataID=40. | ||||
| CVE-2024-35556 | 1 Idccms | 1 Idccms | 2025-04-09 | 8.8 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsSys_deal.php?mudi=infoSet. | ||||
| CVE-2024-35557 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 5.5 Medium |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/vpsApi_deal.php?mudi=rev&nohrefStr=close. | ||||
| CVE-2024-35558 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 8.8 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=rev&nohrefStr=close. | ||||
| CVE-2024-35559 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 8.8 High |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/infoMove_deal.php?mudi=rev&nohrefStr=close. | ||||
| CVE-2024-35560 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 4.3 Medium |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=del&dataType=&dataTypeCN. | ||||
| CVE-2024-35561 | 2 Idccms, Idccms Project | 2 Idccms, Idccms | 2025-04-09 | 5.4 Medium |
| idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/ca_deal.php?mudi=add&nohrefStr=close. | ||||
| CVE-2025-30401 | 1 Whatsapp | 1 Whatsapp | 2025-04-09 | 6.7 Medium |
| A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler based on the attachment’s filename extension. A maliciously crafted mismatch could have caused the recipient to inadvertently execute arbitrary code rather than view the attachment when manually opening the attachment inside WhatsApp. We have not seen evidence of exploitation in the wild. | ||||
| CVE-2022-4325 | 1 Ifeelweb | 1 Post Status Notifier Lite | 2025-04-09 | 6.1 Medium |
| The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin. | ||||
| CVE-2021-46871 | 1 Phoenixframework | 1 Phoenix Html | 2025-04-09 | 6.1 Medium |
| tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes. | ||||
| CVE-2017-20166 | 1 Ecto Project | 1 Ecto | 2025-04-09 | 9.8 Critical |
| Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is_nil and raise. | ||||
| CVE-2024-13744 | 1 Booster | 1 Booster For Woocommerce | 2025-04-09 | 8.1 High |
| The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the validate_product_input_fields_on_add_to_cart function in versions 4.0.1 to 7.2.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. | ||||
| CVE-2024-13708 | 1 Booster | 1 Booster For Woocommerce | 2025-04-09 | 7.2 High |
| The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in versions 4.0.1 to 7.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | ||||
| CVE-2025-28400 | 1 Ruoyi | 1 Ruoyi | 2025-04-09 | 6.7 Medium |
| An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method | ||||
| CVE-2025-28401 | 1 Ruoyi | 1 Ruoyi | 2025-04-09 | 6.7 Medium |
| An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter | ||||
| CVE-2025-28402 | 1 Ruoyi | 1 Ruoyi | 2025-04-09 | 9.8 Critical |
| An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter | ||||