Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2589 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-28089 1 Maccms 1 Maccms 2025-04-07 9.1 Critical
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) via the Scheduled Task function.
CVE-2025-28090 1 Maccms 1 Maccms 2025-04-07 9.1 Critical
maccms10 v2025.1000.4047 is vulnerable to Server-Side Request Forgery (SSRF) in the Collection Custom Interface feature.
CVE-2025-28091 1 Maccms 1 Maccms 2025-04-07 9.1 Critical
maccms10 v2025.1000.4047 has a Server-Side Request Forgery (SSRF) vulnerability via Add Article.
CVE-2025-28092 1 Shopxo 1 Shopxo 2025-04-07 6.3 Medium
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.
CVE-2025-28093 1 Shopxo 1 Shopxo 2025-04-07 6.3 Medium
ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.
CVE-2025-28094 1 Shopxo 1 Shopxo 2025-04-07 6.5 Medium
shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.
CVE-2025-28096 1 Onenav 1 Onenav 2025-04-07 5.4 Medium
OneNav 1.1.0 is vulnerable to Server-Side Request Forgery (SSRF) in custom headers.
CVE-2023-22316 1 Pixela 2 Pix-rt100, Pix-rt100 Firmware 2025-04-04 6.5 Medium
Hidden functionality vulnerability in PIX-RT100 versions RT100_TEQ_2.1.1_EQ101 and RT100_TEQ_2.1.2_EQ101 allows a network-adjacent attacker to access the product via undocumented Telnet or SSH services.
CVE-2022-45926 1 Opentext 1 Opentext Extended Ecm 2025-04-04 8.8 High
An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports.
CVE-2024-38791 1 Meowapps 1 Ai Engine 2025-04-04 4.9 Medium
Server-Side Request Forgery (SSRF) vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot allows Server Side Request Forgery.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.4.7.
CVE-2025-1548 1 Iteachyou 1 Dreamer Cms 2025-04-04 3.5 Low
A vulnerability was found in iteachyou Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/archives/edit. The manipulation of the argument editorValue/answer/content leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-12450 1 Infiniflow 1 Ragflow 2025-04-04 9.8 Critical
In infiniflow/ragflow versions 0.12.0, the `web_crawl` function in `document_app.py` contains multiple vulnerabilities. The function does not filter URL parameters, allowing attackers to exploit Full Read SSRF by accessing internal network addresses and viewing their content through the generated PDF files. Additionally, the lack of restrictions on the file protocol enables Arbitrary File Read, allowing attackers to read server files. Furthermore, the use of an outdated Chromium headless version with --no-sandbox mode enabled makes the application susceptible to Remote Code Execution (RCE) via known Chromium v8 vulnerabilities. These issues are resolved in version 0.14.0.
CVE-2022-47732 1 Yeastar 4 N412, N412 Firmware, N824 and 1 more 2025-04-03 7.5 High
In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.
CVE-2002-1657 1 Postgresql 1 Postgresql 2025-04-03 7.5 High
PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.
CVE-2001-0967 1 Arkeia 1 Arkeia 2025-04-03 9.8 Critical
Knox Arkeia server 4.2, and possibly other versions, uses a constant salt when encrypting passwords using the crypt() function, which makes it easier for an attacker to conduct brute force password guessing.
CVE-2006-1058 3 Avaya, Busybox, Redhat 6 Aura Application Enablement Services, Aura Sip Enablement Services, Message Networking and 3 more 2025-04-03 5.5 Medium
BusyBox 1.1.1 does not use a salt when generating passwords, which makes it easier for local users to guess passwords from a stolen password file using techniques such as rainbow tables.
CVE-2002-1484 1 Siemens 1 Db4web 2025-04-03 9.8 Critical
DB4Web server, when configured to use verbose debug messages, allows remote attackers to use DB4Web as a proxy and attempt TCP connections to other systems (port scan) via a request for a URL that specifies the target IP address and port, which produces a connection status in the resulting error message.
CVE-2005-0408 1 Citrusdb 1 Citrusdb 2025-04-03 9.8 Critical
CitrusDB 0.3.6 and earlier generates easily predictable MD5 hashes of the user name for the id_hash cookie, which allows remote attackers to bypass authentication and gain privileges by calculating the MD5 checksum of the user name combined with the "boogaadeeboo" string, which is hard-coded in the $hidden_hash variable.
CVE-2004-2061 1 Risearch 2 Risearch, Risearch Pro 2025-04-03 9.8 Critical
RiSearch 1.0.01 and RiSearch Pro 3.2.06 allows remote attackers to use the show.pl script as an open proxy, or read arbitrary local files, by setting the url parameter to a (1) http://, (2) ftp://, or (3) file:// URL.
CVE-2024-35635 1 Wpmanageninja 1 Ninja Tables 2025-04-03 4.4 Medium
Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9.