Export limit exceeded: 283245 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (283258 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-36531 | 1 Nukeviet | 2 Egovernment, Nukeviet | 2025-09-15 | 5.7 Medium |
| nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before are vulnerable to arbitrary code execution via the /admin/extensions/upload.php component. | ||||
| CVE-2024-36528 | 1 Nukeviet | 2 Egovernment, Nukeviet | 2025-09-15 | 8.8 High |
| nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /admin/extensions/download.php and /admin/extensions/upload.php. | ||||
| CVE-2025-6709 | 1 Mongodb | 1 Mongodb | 2025-09-15 | 7.5 High |
| The MongoDB Server is susceptible to a denial of service vulnerability due to improper handling of specific date values in JSON input when using OIDC authentication. This can be reproduced using the mongo shell to send a malicious JSON payload leading to an invariant failure and server crash. This issue affects MongoDB Server v7.0 versions prior to 7.0.17 and MongoDB Server v8.0 versions prior to 8.0.5. The same issue affects MongoDB Server v6.0 versions prior to 6.0.21, but an attacker can only induce denial of service after authenticating. | ||||
| CVE-2025-6772 | 2 Dbgpt, Eosphoros-ai | 2 Db-gpt, Db-gpt | 2025-09-15 | 7.3 High |
| A vulnerability was found in eosphoros-ai db-gpt up to 0.7.2. It has been classified as critical. Affected is the function import_flow of the file /api/v2/serve/awel/flow/import. The manipulation of the argument File leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2021-47348 | 1 Linux | 1 Linux Kernel | 2025-09-15 | 9.1 Critical |
| In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid HDCP over-read and corruption Instead of reading the desired 5 bytes of the actual target field, the code was reading 8. This could result in a corrupted value if the trailing 3 bytes were non-zero, so instead use an appropriately sized and zero-initialized bounce buffer, and read only 5 bytes before casting to u64. | ||||
| CVE-2025-52161 | 2 Scholl, Weblication | 2 Weblication Cms, Cms Core & Grid | 2025-09-12 | 9.8 Critical |
| Scholl Communications AG Weblication CMS Core v019.004.000.000 was discovered to contain a cross-site scripting (XSS) vulnerability. | ||||
| CVE-2025-57141 | 2 Rsbi, Ruisitech | 2 Os, Ruisibi | 2025-09-12 | 9.8 Critical |
| rsbi-os 4.7 is vulnerable to Remote Code Execution (RCE) in sqlite-jdbc. | ||||
| CVE-2025-51586 | 1 Prestashop | 1 Prestashop | 2025-09-12 | 3.7 Low |
| An issue was discoverd in file controllers/admin/AdminLoginController.php in PrestaShop before 8.2.1 allowing attackers to gain sensitive information via the reset password feature. | ||||
| CVE-2025-10100 | 1 Oretnom23 | 1 Simple Forum\/discussion System | 2025-09-12 | 7.3 High |
| A vulnerability was detected in SourceCodester Simple Forum Discussion System 1.0. This impacts an unknown function of the file /admin_class.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2025-56265 | 1 N8n | 1 N8n | 2025-09-12 | 8.8 High |
| An arbitrary file upload vulnerability in the Chat Trigger component of N8N v1.95.3, v1.100.1, and v1.101.1 allows attackers to execute arbitrary code via uploading a crafted HTML file. | ||||
| CVE-2025-56266 | 1 Avigilon | 1 Access Control Manager | 2025-09-12 | 9.8 Critical |
| A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. | ||||
| CVE-2025-56267 | 1 Avigilon | 1 Access Control Manager | 2025-09-12 | 9.8 Critical |
| A CSV injection vulnerability in the /id_profiles endpoint of Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via suuplying a crafted Excel file. | ||||
| CVE-2023-3712 | 1 Honeywell | 2 Pm43, Pm43 Firmware | 2025-09-12 | 6.6 Medium |
| Files or Directories Accessible to External Parties vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Privilege Escalation.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). | ||||
| CVE-2023-3711 | 1 Honeywell | 2 Pm43, Pm43 Firmware | 2025-09-12 | 6.4 Medium |
| Session Fixation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Session Credential Falsification through Prediction.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). | ||||
| CVE-2023-3710 | 1 Honeywell | 13 Pc23 43, Pd43, Pm23 43 and 10 more | 2025-09-12 | 9.9 Critical |
| Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006). | ||||
| CVE-2017-1000190 | 2 Apache, Simplexml Project | 2 Solr, Simplexml | 2025-09-12 | 9.1 Critical |
| SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on. | ||||
| CVE-2022-24614 | 2 Metadata-extractor Project, Redhat | 2 Metadata-extractor, Jboss Fuse | 2025-09-12 | 5.5 Medium |
| When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library. | ||||
| CVE-2019-11272 | 3 Debian, Redhat, Vmware | 3 Debian Linux, Jboss Fuse, Spring Security | 2025-09-12 | 7.3 High |
| Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of "null". | ||||
| CVE-2019-5312 | 1 Wxjava Project | 1 Wxjava | 2025-09-12 | 9.8 Critical |
| An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318. | ||||
| CVE-2023-42276 | 1 Hutool | 1 Hutool | 2025-09-12 | 9.8 Critical |
| hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray. | ||||