Search

Expected end of text, found '.' (at char 23), (line:1, col:24)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (331873 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-30356 1 Ovaledge 1 Ovaledge 2024-10-31 8.8 High
OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.
CVE-2024-49634 1 Rimonhabib 1 Bp Member Type Manager 2024-10-31 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rimon Habib BP Member Type Manager allows Reflected XSS.This issue affects BP Member Type Manager: from n/a through 1.01.
CVE-2024-8143 1 Gaizhenbiao 1 Chuanhuchatgpt 2024-10-31 4.3 Medium
In the latest version (20240628) of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint, an authenticated user can enumerate and access files in other users' directories, leading to unauthorized access to private chat histories. This vulnerability can be exploited to read any user's private chat history.
CVE-2024-49641 1 Tidaweb 1 Tida Url Screenshot 2024-10-31 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tidaweb Tida URL Screenshot allows Reflected XSS.This issue affects Tida URL Screenshot: from n/a through 1.0.
CVE-2024-49640 1 Amadercodelab 1 Acl Floating Cart For Woocommerce 2024-10-31 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AmaderCode Lab ACL Floating Cart for WooCommerce allows Reflected XSS.This issue affects ACL Floating Cart for WooCommerce: from n/a through 0.9.
CVE-2024-49639 1 Edwardstoever 1 Monitor.chat 2024-10-31 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Edward Stoever Monitor.Chat allows Reflected XSS.This issue affects Monitor.Chat: from n/a through 1.1.1.
CVE-2024-48230 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.
CVE-2024-49638 1 Aliazlan 1 Risk Warning Bar 2024-10-31 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali Azlan Risk Warning Bar allows Reflected XSS.This issue affects Risk Warning Bar: from n/a through 1.0.
CVE-2024-48229 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.
CVE-2024-7783 2 Miniplex Labs, Mintplexlabs 2 Miniplex Labs\/anything Lim, Anythingllm 2024-10-31 7.5 High
mintplex-labs/anything-llm version latest contains a vulnerability where sensitive information, specifically a password, is improperly stored within a JWT (JSON Web Token) used as a bearer token in single user mode. When decoded, the JWT reveals the password in plaintext. This improper storage of sensitive information poses significant security risks, as an attacker who gains access to the JWT can easily decode it and retrieve the password. The issue is fixed in version 1.0.3.
CVE-2024-48227 1 Funadmin 1 Funadmin 2024-10-31 7.5 High
Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).
CVE-2024-48223 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.
CVE-2024-48222 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.
CVE-2024-48218 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.
CVE-2024-48226 1 Funadmin 1 Funadmin 2024-10-31 9.8 Critical
Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.
CVE-2024-48225 1 Funadmin 1 Funadmin 2024-10-31 9.1 Critical
Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.
CVE-2023-31310 2024-10-31 5 Medium
Improper input validation in Power Management Firmware (PMFW) may allow an attacker with privileges to send a malformed input for the "set temperature input selection" command, potentially resulting in a loss of integrity and/or availability.
CVE-2024-48224 1 Funadmin 1 Funadmin 2024-10-31 7.5 High
Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.
CVE-2024-49635 2 Manzurul Haque, Manzurulhaque 2 Banner Slider, Banner Slider 2024-10-31 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Manzurul Haque Banner Slider allows Reflected XSS.This issue affects Banner Slider: from n/a through 2.1.
CVE-2023-50355 1 Hcltech 1 Sametime 2024-10-31 3.6 Low
HCL Sametime is impacted by the error messages containing sensitive information. An attacker can use this information to launch another, more focused attack.