Search

Expected end of text, found '.' (at char 16), (line:1, col:17)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (332684 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-49605 1 Avchat.net 1 Avchat Video Chat 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2.
CVE-2024-49335 1 Edush Maxim 1 Googledrive Folder List 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2.
CVE-2024-47325 1 Themeisle 1 Multiple Page Generator 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.7.
CVE-2024-48657 2 Itsourcecode, Princelycesar 2 Hospital Management System, Hospital Management System 2024-10-24 8.1 High
SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.
CVE-2024-48656 2 Angeljudesuarez, Itsourcecode 2 Student Management System, Student Management System 2024-10-24 5.4 Medium
Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.
CVE-2024-49625 2 Brandon Clark, Brandonclark 2 Site Builder Dynamic Components, Sitebuilder Dynamic Components 2024-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in Brandon Clark SiteBuilder Dynamic Components allows Object Injection.This issue affects SiteBuilder Dynamic Components: from n/a through 1.0.
CVE-2024-49624 1 Smartdevth 1 Advanced Advertising System 2024-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in Smartdevth Advanced Advertising System allows Object Injection.This issue affects Advanced Advertising System: from n/a through 1.3.1.
CVE-2024-10195 1 Tecno-mobile 2 4g Portable Wifi Tr118, 4g Portable Wifi Tr118 Firmware 2024-10-24 4.7 Medium
A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-49622 1 Apa 1 Apa Banner Slider 2024-10-24 8.2 High
Cross-Site Request Forgery (CSRF) vulnerability in Apa Apa Banner Slider allows SQL Injection.This issue affects Apa Banner Slider: from n/a through 1.0.0.
CVE-2024-49623 1 Hasanmovahed 1 Duplicate Title Validate 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hasan Movahed Duplicate Title Validate allows Blind SQL Injection.This issue affects Duplicate Title Validate: from n/a through 1.0.
CVE-2024-49631 1 Mdabdulkader 1 Easy Addons For Elementor 2024-10-24 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Md Abdul Kader Easy Addons for Elementor allows Stored XSS.This issue affects Easy Addons for Elementor: from n/a through 1.3.0.
CVE-2024-10200 1 Wellchoose 1 Administrative Management System 2024-10-24 7.5 High
Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server.
CVE-2024-10201 1 Wellchoose 1 Administrative Management System 2024-10-24 8.8 High
Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.
CVE-2024-8625 2 Pollbytotalsoft, Total-soft 2 Ts Poll, Ts Poll 2024-10-24 7.2 High
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVE-2024-43945 1 Latepoint 1 Latepoint 2024-10-24 6.5 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.
CVE-2024-47328 1 Funnelkit 1 Funnelkit Automations 2024-10-24 7.6 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Automation By Autonami allows SQL Injection.This issue affects Automation By Autonami: from n/a through 3.1.2.
CVE-2024-9923 1 Teamplus 1 Team\+ Pro 2024-10-24 4.9 Medium
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them.
CVE-2024-9922 1 Teamplus 2 Team\+, Team\+ Pro 2024-10-24 7.5 High
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
CVE-2024-9921 1 Teamplus 2 Team\+, Team\+ Pro 2024-10-24 9.8 Critical
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify and delete database contents.
CVE-2024-10286 1 Ujangrohidin 1 Localserver 2024-10-24 6.1 Medium
Cross-Site Scripting (XSS) vulnerability affecting LocalServer 1.0.9 that could allow a remote user to send a specially crafted query to an authenticated user and steal their session details through /testmail/index.php, parameter to.