Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328236 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-38327 1 Ueberhamm-design 1 Youtube Video Inserter 2025-05-02 6.1 Medium
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0.
CVE-2021-38354 1 Gnu-mailman Integration Project 1 Gnu-mailman Integration 2025-05-02 6.1 Medium
The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm_error parameter found in the ~/includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6.
CVE-2025-25993 1 Feminer Wms Project 1 Feminer Wms 2025-05-02 5.1 Medium
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameter "itemid."
CVE-2025-25994 1 Feminer Wms Project 1 Feminer Wms 2025-05-02 7.5 High
SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id.
CVE-2021-38359 1 Invitebox 1 Invitebox 2025-05-02 6.1 Medium
The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the ~/admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1.
CVE-2021-38358 1 Kibokolabs 1 Moolamojo 2025-05-02 6.1 Medium
The MoolaMojo WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the classes parameter found in the ~/views/button-generator.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.4.1.
CVE-2021-38357 1 Elyazalee 1 Sms-ovh 2025-05-02 6.1 Medium
The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
CVE-2022-39019 1 M-files 1 Hubshare 2025-05-02 6.3 Medium
Broken access controls on PDFtron WebviewerUI in M-Files Hubshare before 3.3.11.3 allows unauthenticated attackers to upload malicious files to the application server.
CVE-2025-32754 1 Jenkins 1 Ssh-agent 2025-05-02 9.1 Critical
In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
CVE-2022-44624 1 Jetbrains 1 Teamcity 2025-05-02 6.5 Medium
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters
CVE-2022-44646 1 Jetbrains 1 Teamcity 2025-05-02 2.2 Low
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
CVE-2024-27684 1 Dlink 2 Go-rt-ac750, Go-rt-ac750 Firmware 2025-05-02 6.1 Medium
A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2024-57684 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 9.8 Critical
An access control issue in the component formDMZ.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the DMZ service of the device via a crafted POST request.
CVE-2024-57683 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 4.3 Medium
An access control issue in the component websURLFilterAddDel of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the filter settings of the device via a crafted POST request.
CVE-2024-57682 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An information disclosure vulnerability in the component d_status.asp of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to access sensitive information via a crafted POST request.
CVE-2024-57681 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 5.3 Medium
An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request.
CVE-2024-57680 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 5.3 Medium
An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request.
CVE-2024-57679 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request.
CVE-2024-57678 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request.
CVE-2024-57677 1 Dlink 2 Dir-816, Dir-816 Firmware 2025-05-02 6.5 Medium
An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request.