Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (42958 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-14414 1 Dlink 2 Dir-850l, Dir-850l Firmware 2025-04-20 6.1 Medium
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/shareport.php.
CVE-2016-3113 1 Redhat 1 Ovirt-engine 2025-04-20 6.1 Medium
Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.
CVE-2017-14413 1 Dlink 2 Dir-850l, Dir-850l Firmware 2025-04-20 6.1 Medium
D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) devices have XSS in the action parameter to htdocs/web/wpsacts.php.
CVE-2017-2187 1 3cx 1 Live Chat 2025-04-20 N/A
Cross-site scripting vulnerability in WP Live Chat Support prior to version 7.0.07 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2017-13138 1 Qodeinteractive 1 Bridge 2025-04-20 N/A
DOM based Cross-site scripting (XSS) vulnerability in the Bridge theme before 11.2 for WordPress allows remote attackers to inject arbitrary JavaScript.
CVE-2017-14516 1 Sap 1 Businessobjects Financial Consolidation 2025-04-20 N/A
Cross-Site Scripting (XSS) exists in SAP Business Objects Financial Consolidation before 2017-06-13, aka SAP Security Note 2422292.
CVE-2017-15909 1 Dlink 2 Dgs-1500, Dgs-1500 Firmware 2025-04-20 N/A
D-Link DGS-1500 Ax devices before 2.51B021 have a hardcoded password, which allows remote attackers to obtain shell access.
CVE-2016-4327 1 Wso2 1 Enablement Server For Java 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in WSO2 SOA Enablement Server for Java/6.6 build SSJ-6.6-20090827-1616 and earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.
CVE-2017-7248 1 Gazelle Project 1 Gazelle 2025-04-20 N/A
A Cross-Site Scripting (XSS) was discovered in Gazelle before 2017-03-19. The vulnerability exists due to insufficient filtration of user-supplied data (type) passed to the 'Gazelle-master/sections/better/transcode.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVE-2017-7257 1 Cmsmadesimple 1 Cms Made Simple 2025-04-20 N/A
XSS exists in the CMS Made Simple (CMSMS) 2.1.6 "Content-->News-->Add Article" feature via the m1_content parameter. Someone must login to conduct the attack.
CVE-2014-5144 1 Telescopeapp 1 Telescope 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Telescope before 0.9.3 allows remote authenticated users to inject arbitrary web script or HTML via crafted markdown.
CVE-2017-7271 1 Yii Software 1 Yii 2025-04-20 N/A
Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
CVE-2017-7362 1 Lucidcrew 1 Pixie 2025-04-20 N/A
Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.
CVE-2017-7386 1 Symetrie Project 1 Symetrie 2025-04-20 N/A
citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).
CVE-2016-4457 1 Redhat 2 Cloudforms Management Engine, Cloudforms Managementengine 2025-04-20 N/A
CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.
CVE-2017-7387 1 Helpmewatchwho Project 1 Helpmewatchwho 2025-04-20 N/A
TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter).
CVE-2017-14735 1 Antisamy Project 1 Antisamy 2025-04-20 N/A
OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities, as demonstrated by use of : to construct a javascript: URL.
CVE-2017-11479 2 Elastic, Elasticsearch 2 Kibana, Kibana 2025-04-20 N/A
Kibana versions prior to 5.6.1 had a cross-site scripting (XSS) vulnerability in Timelion that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
CVE-2017-11441 1 Cpanel 1 Whm 2025-04-20 N/A
The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before 66.0.2 has XSS via a locale filename, aka SEC-297.
CVE-2017-11439 1 Sitecore 1 Cms 2025-04-20 N/A
In Sitecore 8.2, there is reflected XSS in the shell/Applications/Tools/Run Program parameter.