Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (42958 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-34230 1 Sourcecodester 1 Laboratory Management System 2025-04-22 6.1 Medium
A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter.
CVE-2024-34231 1 Sourcecodester 1 Laboratory Management System 2025-04-22 7.1 High
A cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Short Name parameter.
CVE-2024-33304 2 Oretnom23, Sourcecodester 2 Product Show Room Site, Product Show Room 2025-04-22 6.1 Medium
SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" under Add Users.
CVE-2024-33306 1 Sourcecodester 1 Laboratory Management System 2025-04-22 7.4 High
SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" parameter in Create User.
CVE-2024-25147 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-04-22 9.6 Critical
Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via crafted javascript: style links.
CVE-2024-26269 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-04-22 9.6 Critical
Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.4 before update 38, 7.3 before update 11, 7.2 before fix pack 20, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via the anchor (hash) part of a URL.
CVE-2023-44379 1 Basercms 1 Basercms 2025-04-22 6.1 Medium
baserCMS is a website development framework. Prior to version 5.0.9, there is a cross-site scripting vulnerability in the site search feature. Version 5.0.9 contains a fix for this vulnerability.
CVE-2024-33307 1 Sourcecodester 1 Laboratory Management System 2025-04-22 5.4 Medium
SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Last Name" parameter in Create User.
CVE-2024-33302 2 Oretnom23, Sourcecodester 2 Product Show Room Site, Product Show Room 2025-04-22 5.3 Medium
SourceCodester Product Show Room 1.0 and before is vulnerable to Cross Site Scripting (XSS) via "Middle Name" under Add Users.
CVE-2024-33303 2 Oretnom23, Sourcecodester 2 Product Show Room Site, Product Show Room 2025-04-22 8.2 High
SourceCodester Product Show Room 1.0 is vulnerable to Cross Site Scripting (XSS) via "First Name" under Add Users.
CVE-2022-42141 1 Deltaww 2 Dx-2100-l1-cn, Dx-2100-l1-cn Firmware 2025-04-22 5.4 Medium
Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter.
CVE-2022-31358 1 Proxmox 1 Virtual Environment 2025-04-22 9 Critical
A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or HTML via non-existent endpoints under path /api2/html/.
CVE-2024-33305 1 Sourcecodester 1 Laboratory Management System 2025-04-22 6.1 Medium
SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter in Create User.
CVE-2024-1323 1 Themeisle 1 Orbit Fox 2025-04-22 6.4 Medium
The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Post Type Grid Widget Title in all versions up to, and including, 2.10.30 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2022-39262 1 Glpi-project 1 Glpi 2025-04-22 5.2 Medium
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4.
CVE-2022-39277 1 Glpi-project 1 Glpi 2025-04-22 4.5 Medium
GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds.
CVE-2022-34560 1 Phpfox 1 Phpfox 2025-04-22 7.1 High
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the History parameter.
CVE-2022-34561 1 Phpfox 1 Phpfox 2025-04-22 4.3 Medium
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the video description parameter.
CVE-2022-34562 1 Phpfox 1 Phpfox 2025-04-22 6.1 Medium
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the status box.
CVE-2024-7068 1 Munyweki 1 Insurance Management System 2025-04-22 3.5 Low
A vulnerability classified as problematic has been found in SourceCodester Insurance Management System 1.0. This affects an unknown part of the file /Script/admin/core/update_sub_category. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-272349 was assigned to this vulnerability.