Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328883 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-0167 1 Dell 1 Unity Operating Environment 2025-05-06 7.8 High
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges.
CVE-2024-0165 1 Dell 1 Unity Operating Environment 2025-05-06 7.8 High
Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility. An authenticated attacker could potentially exploit this vulnerability, leading to execution of arbitrary operating system commands with root privileges.
CVE-2024-28151 1 Jenkins 1 Html Publisher 2025-05-06 4.3 Medium
Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the controller, allowing attackers with Item/Configure permission to determine whether a path on the Jenkins controller file system exists, without being able to access it.
CVE-2024-28150 1 Jenkins 1 Html Publisher 2025-05-06 4.7 Medium
Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frame, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2024-28149 2 Jenkins, Redhat 2 Html Publisher, Ocp Tools 2025-05-06 6.5 Medium
Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting (XSS) attacks and to determine whether a path on the Jenkins controller file system exists.
CVE-2025-28017 1 Totolink 2 A800r, A800r Firmware 2025-05-06 6.5 Medium
TOTOLINK A800R V4.1.2cu.5032_B20200408 is vulnerable to Command Injection in downloadFile.cgi via the QUERY_STRING parameter.
CVE-2025-28018 1 Totolink 2 A800r, A800r Firmware 2025-05-06 7.3 High
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v14 parameter.
CVE-2025-28019 1 Totolink 2 A800r, A800r Firmware 2025-05-06 7.3 High
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi component
CVE-2025-28020 1 Totolink 2 A800r, A800r Firmware 2025-05-06 7.3 High
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2025-28021 1 Totolink 2 A810r, A810r Firmware 2025-05-06 7.3 High
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters
CVE-2025-28022 1 Totolink 2 A810r, A810r Firmware 2025-05-06 7.3 High
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2024-51243 1 Eladmin 1 Eladmin 2025-05-06 7.2 High
The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
CVE-2024-51060 2 Online Admission System Project, Projectworlds 2 Online Admission System, Online Admission System 2025-05-06 9.1 Critical
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter.
CVE-2022-40296 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9.8 Critical
The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.
CVE-2022-40293 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9.8 Critical
The application was vulnerable to a session fixation that could be used hijack accounts.
CVE-2022-40292 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 5.3 Medium
The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.
CVE-2022-40291 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 8.8 High
The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.
CVE-2022-40290 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 6.1 Medium
The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that could compromise users.
CVE-2022-40289 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9 Critical
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.
CVE-2022-40288 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9 Critical
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.