Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 40371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ',' (at char 15), (line:1, col:16)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40371 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-45492 1 Netgear 2 Ex8000, Ex8000 Firmware 2025-05-13 6.5 Medium
Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function.
CVE-2025-45491 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 9.8 Critical
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter.
CVE-2025-45490 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 6.5 Medium
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter.
CVE-2025-45489 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 6.5 Medium
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter.
CVE-2025-45488 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 6.5 Medium
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter.
CVE-2025-45487 1 Linksys 2 E5600, E5600 Firmware 2025-05-13 6.5 Medium
Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.
CVE-2025-23379 1 Dell 1 Storage Manager 2025-05-13 3.5 Low
Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
CVE-2025-22479 1 Dell 1 Storage Manager 2025-05-13 3.5 Low
Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
CVE-2025-4311 1 Emiloi 1 Content Management System 2025-05-13 7.3 High
A vulnerability classified as critical was found in itsourcecode Content Management System 1.0. This vulnerability affects unknown code of the file /admin/update_main_topic_img.php?topic_id=529. The manipulation of the argument stopic_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4298 1 Tenda 2 Ac1206, Ac1206 Firmware 2025-05-13 8.8 High
A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been declared as critical. This vulnerability affects the function formSetCfm of the file /goform/setcfm. The manipulation leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-4299 1 Tenda 2 Ac1206, Ac1206 Firmware 2025-05-13 8.8 High
A vulnerability was found in Tenda AC1206 up to 15.03.06.23. It has been rated as critical. This issue affects the function setSchedWifi of the file /goform/openSchedWifi. The manipulation leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-44074 1 Seacms 1 Seacms 2025-05-13 9.8 Critical
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_topic.php.
CVE-2025-44072 1 Seacms 1 Seacms 2025-05-13 9.8 Critical
SeaCMS v13.3 was discovered to contain a SQL injection vulnerability via the component admin_manager.php.
CVE-2025-44071 1 Seacms 1 Seacms 2025-05-13 9.8 Critical
SeaCMS v13.3 was discovered to contain a remote code execution (RCE) vulnerability via the component phomebak.php. This vulnerability allows attackers to execute arbitrary code via a crafted request.
CVE-2024-57099 1 Classcms 1 Classcms 2025-05-13 9.8 Critical
ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model management feature, allowing them to execute arbitrary code and potentially take control of the server.
CVE-2024-57450 1 1000mz 1 Chestnutcms 2025-05-13 9.8 Critical
ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.
CVE-2024-57452 1 1000mz 1 Chestnutcms 2025-05-13 7.5 High
ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder.
CVE-2024-57451 1 1000mz 1 Chestnutcms 2025-05-13 7.5 High
ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory.
CVE-2025-24899 1 Yogeshojha 1 Rengine 2025-05-13 7.5 High
reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-24962 1 Yogeshojha 1 Rengine 2025-05-13 8.8 High
reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.