Search

Expected end of text, found '.' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (356047 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-23205 1 Monstra 1 Monstra Cms 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the "Site Name" field under the "Site Settings" module.
CVE-2020-23194 1 Phplist 1 Phplist 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in the "Import Subscribers" feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2020-23192 1 Phplist 1 Phplist 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the "admin" parameter under the "Manage administrators" module.
CVE-2020-23190 1 Phplist 1 Phplist 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in the "Import emails" module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2020-23185 1 Php-fusion 1 Php-fusion 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2020-23184 1 Php-fusion 1 Php-fusion 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in /administration/settings_registration.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Registration" field.
CVE-2020-23182 1 Php-fusion 1 Php-fusion 2024-11-21 5.4 Medium
The component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel.
CVE-2020-23181 1 Php-fusion 1 Php-fusion 2024-11-21 5.4 Medium
A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field.
CVE-2020-23179 1 Php-fusion 1 Php-fusion 2024-11-21 5.4 Medium
A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Site footer" field.
CVE-2020-23178 1 Php-fusion 1 Php-fusion 2024-11-21 5.4 Medium
An issue exists in PHP-Fusion 9.03.50 where session cookies are not deleted once a user logs out, allowing for an attacker to perform a session replay attack and impersonate the victim user.
CVE-2020-23172 1 Kuba Project 1 Kuba 2024-11-21 5.5 Medium
A vulnerability in all versions of Kuba allows attackers to overwrite arbitrary files in arbitrary directories with crafted Zip files due to improper validation of file paths in .zip archives.
CVE-2020-23171 1 Nim-lang 1 Nim-lang 2024-11-21 5.5 Medium
A vulnerability in all versions of Nim-lang allows unauthenticated attackers to write files to arbitrary directories via a crafted zip file with dot-slash characters included in the name of the crafted file.
CVE-2020-23162 1 Pyres 2 Termod4, Termod4 Firmware 2024-11-21 7.5 High
Sensitive information disclosure and weak encryption in Pyrescom Termod4 time management devices before 10.04k allows remote attackers to read a session-file and obtain plain-text user credentials.
CVE-2020-23161 1 Pyres 2 Termod4, Termod4 Firmware 2024-11-21 6.5 Medium
Local file inclusion in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to traverse directories and read sensitive files via the Maintenance > Logs menu and manipulating the file-path in the URL.
CVE-2020-23160 1 Pyres 2 Termod4, Termod4 Firmware 2024-11-21 8.8 High
Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices.
CVE-2020-23151 1 Rconfig 1 Rconfig 2024-11-21 9.8 Critical
rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.
CVE-2020-23150 1 Rconfig 1 Rconfig 2024-11-21 7.5 High
A SQL injection vulnerability in config.inc.php of rConfig 3.9.5 allows attackers to access sensitive database information via a crafted GET request to install/lib/ajaxHandlers/ajaxDbInstall.php.
CVE-2020-23149 1 Rconfig 1 Rconfig 2024-11-21 7.5 High
The dbName parameter in ajaxDbInstall.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a SQL injection and access sensitive database information.
CVE-2020-23148 1 Rconfig 1 Rconfig 2024-11-21 7.5 High
The userLogin parameter in ldap/login.php of rConfig 3.9.5 is unsanitized, allowing attackers to perform a LDAP injection and obtain sensitive information via a crafted POST request.
CVE-2020-23140 1 Microweber 1 Microweber 2024-11-21 8.1 High
Microweber 1.1.18 is affected by insufficient session expiration. When changing passwords, both sessions for when a user changes email and old sessions in any other browser or device, the session does not expire and remains active.