Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (47293 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-36843 1 Acurax 1 Floating Social Media Icon 2025-03-28 4.8 Medium
Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Floating Social Media Icon plugin (versions <= 4.3.5) Social Media Configuration form. Requires high role user like admin.
CVE-2021-36919 1 Getawesomesupport 1 Awesome Support 2025-03-28 6.1 Medium
Multiple Authenticated Reflected Cross-Site Scripting (XSS) vulnerabilities in WordPress Awesome Support plugin (versions <= 6.0.6), vulnerable parameters (&id, &assignee).
CVE-2021-36911 1 Comment Engine Pro Project 1 Comment Engine Pro 2025-03-28 4.8 Medium
Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0), could be exploited by users with Editor or higher role.
CVE-2024-55100 1 Phpgurukul 1 Online Nurse Hiring System 2025-03-28 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the fullname parameter.
CVE-2024-1588 1 Pressified 1 Sendpress 2025-03-28 6.8 Medium
The SendPress Newsletters WordPress plugin through 1.23.11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2021-36889 1 Tarteaucitron.js - Cookies Legislation \& Gdpr Project 1 Tarteaucitron.js - Cookies Legislation \& Gdpr 2025-03-28 3.4 Low
Multiple Stored Authenticated Cross-Site Scripting (XSS) vulnerabilities were discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.6).
CVE-2021-36887 1 Tarteaucitron.js - Cookies Legislation \& Gdpr Project 1 Tarteaucitron.js - Cookies Legislation \& Gdpr 2025-03-28 6.1 Medium
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) discovered in tarteaucitron.js – Cookies legislation & GDPR WordPress plugin (versions <= 1.5.4), vulnerable parameters "tarteaucitronEmail" and "tarteaucitronPass".
CVE-2021-36885 1 Ciphercoin 1 Contact Form 7 Database Addon 2025-03-28 6.1 Medium
Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin (versions <= 1.2.6.1).
CVE-2023-24065 1 Nosh Chartingsystem Project 1 Nosh Chartingsystem 2025-03-28 5.4 Medium
NOSH 4a5cfdb allows stored XSS via the create user page. For example, a first name (of a physician, assistant, or billing user) can have a JavaScript payload that is executed upon visiting the /users/2/1 page. This may allow attackers to steal Protected Health Information because the product is for health charting.
CVE-2023-22333 1 Mubag 1 Easymail 2025-03-28 6.1 Medium
Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2022-48118 1 Jorani 1 Jorani 2025-03-28 6.1 Medium
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
CVE-2022-48067 1 Totolink 2 A830r, A830r Firmware 2025-03-28 5.5 Medium
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
CVE-2022-46087 1 Cloudschool Project 1 Cloudschool 2025-03-28 5.4 Medium
CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin users through notification received by the admin user.
CVE-2024-27625 1 Cmsmadesimple 1 Cms Made Simple 2025-03-28 4.8 Medium
CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). This vulnerability resides in the File Manager module of the admin panel. Specifically, the issue arises due to inadequate sanitization of user input in the "New directory" field.
CVE-2023-0566 1 Froxlor 1 Froxlor 2025-03-28 6.2 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in froxlor/froxlor prior to 2.0.10.
CVE-2023-0549 1 Yetanotherforum 1 Yaf.net 2025-03-28 3.5 Low
A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.
CVE-2023-49977 1 Oretnom23 1 Customer Support System 2025-03-28 5.4 Medium
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at /customer_support/index.php?page=new_customer.
CVE-2023-49976 1 Oretnom23 1 Customer Support System 2025-03-28 5.4 Medium
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the subject parameter at /customer_support/index.php?page=new_ticket.
CVE-2023-49974 2 Oretnom23, Sourcecodester 2 Customer Support System, Customer Support System 2025-03-28 6.1 Medium
A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customer_support/index.php?page=customer_list.
CVE-2023-51281 2 Oretnom23, Sourcecodester 2 Customer Support System, Customer Support System 2025-03-28 5.4 Medium
Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script firstname, "lastname", "middlename", "contact" and address parameters.