Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (96461 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-45888 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8 High
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'
CVE-2024-45889 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8 High
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`
CVE-2024-45890 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8 High
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`
CVE-2024-45891 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8 High
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`
CVE-2024-45893 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8 High
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`
CVE-2024-51304 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function.
CVE-2024-51257 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.
CVE-2024-51296 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.
CVE-2024-51299 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.
CVE-2024-51300 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.
CVE-2024-51301 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.
CVE-2024-51258 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.
CVE-2024-51254 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8.8 High
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function.
CVE-2024-46316 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 8 High
DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 function at /cgi-bin/mainfunction.cgi. This vulnerability allows attackers to execute arbitrary commands via supplying a crafted HTTP message.
CVE-2024-9099 1 Lunary 1 Lunary 2025-04-10 8.1 High
In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all projects to users with minimal permissions, such as Viewers or Prompt Editors. This vulnerability allows unauthorized users to retrieve sensitive credentials, which can be used to perform actions on behalf of the project, access private data, and delete resources. The private API keys are exposed in the developer tools when the endpoint is called from the frontend.
CVE-2024-57762 1 Wangl1989 1 Mysiteforme 2025-04-10 7.5 High
MSFM before v2025.01.01 was discovered to contain a deserialization vulnerability via the pom.xml configuration file.
CVE-2024-57765 1 Wangl1989 1 Mysiteforme 2025-04-10 7.5 High
MSFM before 2025.01.01 was discovered to contain a SQL injection vulnerability via the s_name parameter at table/list.
CVE-2024-57767 1 Wangl1989 1 Mysiteforme 2025-04-10 8.6 High
MSFM before v2025.01.01 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /file/download.
CVE-2022-39040 1 Aenrich 1 A\+hrd 2025-04-10 7.5 High
aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and download arbitrary system files.
CVE-2021-29100 1 Esri 1 Arcgis Earth 2025-04-10 7.8 High
A path traversal vulnerability exists in Esri ArcGIS Earth versions 1.11.0 and below which allows arbitrary file creation on an affected system through crafted input. An attacker could exploit this vulnerability to gain arbitrary code execution under security context of the user running ArcGIS Earth by inducing the user to upload a crafted file to an affected system.