Export limit exceeded: 43035 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16951 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 43035 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 41), (line:1, col:42)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43035 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-4859 1 Dlink 2 Dap-2695, Dap-2695 Firmware 2025-05-22 2.4 Low
A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing of the file /adv_macbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument f_mac leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-4860 1 Dlink 2 Dap-2695, Dap-2695 Firmware 2025-05-22 2.4 Low
A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps.php of the component Static Pool Settings Page. The manipulation of the argument f_mac leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2023-6572 1 Gradio Project 1 Gradio 2025-05-22 8.1 High
Command Injection in GitHub repository gradio-app/gradio prior to main.
CVE-2024-48311 1 Piwigo 1 Piwigo 2025-05-22 8.8 High
Piwigo v14.5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit album function.
CVE-2025-3516 1 Archetyped 1 Simple Lightbox 2025-05-22 5.9 Medium
The Simple Lightbox WordPress plugin before 2.9.4 does not validate and escape some of its attributes before outputting them back in a page/post, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVE-2025-32728 2 Debian, Openbsd 2 Debian Linux, Openssh 2025-05-22 4.3 Medium
In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding.
CVE-2022-32782 1 Apple 1 Macos 2025-05-22 4.4 Medium
This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private information.
CVE-2022-22637 2 Apple, Redhat 8 Ipad Os, Iphone Os, Macos and 5 more 2025-05-22 8.8 High
A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvOS 15.4. A malicious website may cause unexpected cross-origin behavior.
CVE-2025-24977 1 Citeum 1 Opencti 2025-05-22 9.1 Critical
OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the malicious user gets a root shell inside a container this opens up the the infrastructure environment for further attacks and exposures. Version 6.4.11 fixes the issue.
CVE-2025-44854 1 Totolink 2 Cp900, Cp900 Firmware 2025-05-22 6.3 Medium
TOTOLINK CP900 V6.3c.1144_B20190715 was found to contain a command injection vulnerability in the setUpgradeUboot function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44847 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.3 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44846 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.3 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the recvUpgradeNewFw function via the fwUrl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44845 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the NTPSyncWithHost function via the hostTime parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44844 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the setUpgradeFW function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44843 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the url parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44842 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the msg_process function via the Port parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44841 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the version parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44840 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the svn parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44839 1 Totolink 2 Ca600-poe, Ca600-poe Firmware 2025-05-22 6.5 Medium
TOTOLINK CA600-PoE V5.3c.6665_B20180820 was found to contain a command injection vulnerability in the CloudSrvUserdataVersionCheck function via the magicid parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.
CVE-2025-44838 1 Totolink 2 Cp900, Cp900 Firmware 2025-05-22 6.3 Medium
TOTOLINK CPE CP900 V6.3c.1144_B20190715 was discovered to contain a command injection vulnerability in the setUploadUserData function via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request.