Search

Expected end of text, found '.' (at char 39), (line:1, col:40)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (331759 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-44062 1 Wpgogo 1 Custom Field Template 2024-09-27 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Hiroaki Miyashita Custom Field Template allows Stored XSS.This issue affects Custom Field Template: from n/a through 2.6.5.
CVE-2024-44059 1 Mediaron 1 Custom Query Blocks 2024-09-27 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MediaRon LLC Custom Query Blocks allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.3.1.
CVE-2024-44053 1 Mohammadarif 1 Opor Ayam 2024-09-27 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mohammad Arif Opor Ayam allows Reflected XSS.This issue affects Opor Ayam: from n/a through 1.8.
CVE-2024-47058 1 Acquia 1 Mautic 2024-09-27 2.9 Low
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
CVE-2024-47050 1 Acquia 1 Mautic 2024-09-27 5.4 Medium
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
CVE-2024-0005 1 Purestorage 4 Flasharray, Flashblade, Purity\/\/fa and 1 more 2024-09-27 9.1 Critical
A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration.
CVE-2021-27917 1 Acquia 1 Mautic 2024-09-27 7.3 High
Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.
CVE-2024-45460 1 Info-d-74 1 Flipping Cards 2024-09-27 5.9 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Manu225 Flipping Cards allows Stored XSS.This issue affects Flipping Cards: from n/a through 1.30.
CVE-2024-45459 1 Pickplugins 1 Product Slider For Woocommerce 2024-09-27 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PickPlugins Product Slider for WooCommerce allows Reflected XSS.This issue affects Product Slider for WooCommerce: from n/a through 1.13.50.
CVE-2024-37779 1 Woodwing Elvis Dam 1 Woodwing Elvis Dam 2024-09-27 8.8 High
WoodWing Elvis DAM v6.98.1 was discovered to contain an authenticated remote command execution (RCE) vulnerability via the Apache Ant script functionality.
CVE-2024-44063 1 Happyforms 1 Happyforms 2024-09-27 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Happyforms allows Stored XSS.This issue affects Happyforms: from n/a through 1.26.0.
CVE-2024-0004 1 Purestorage 2 Flasharray, Purity\/\/fa 2024-09-27 9.1 Critical
A condition exists in FlashArray Purity whereby an user with array admin role can execute arbitrary commands remotely to escalate privilege on the array.
CVE-2024-0003 1 Purestorage 2 Flasharray, Purity\/\/fa 2024-09-27 9.1 Critical
A condition exists in FlashArray Purity whereby a malicious user could use a remote administrative service to create an account on the array allowing privileged access.
CVE-2024-0002 1 Purestorage 2 Flasharray, Purity\/\/fa 2024-09-27 10 Critical
A condition exists in FlashArray Purity whereby an attacker can employ a privileged account allowing remote access to the array.
CVE-2024-0001 1 Purestorage 2 Flasharray, Purity\/\/fa 2024-09-27 10 Critical
A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active potentially allowing a malicious actor to gain elevated privileges.
CVE-2024-44060 1 Jenniferhall 1 Filmix 2024-09-27 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Jennifer Hall Filmix allows Reflected XSS.This issue affects Filmix: from n/a through 1.1.
CVE-2024-6339 1 Averta 1 Phlox 2024-09-27 6.1 Medium
The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including, 5.16.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2024-8797 1 Wpbookingsystem 1 Wp Booking System 2024-09-27 6.1 Medium
The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0.19.8. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVE-2023-3410 1 Bricksbuilder 1 Bricks 2024-09-27 5.4 Medium
The Bricks theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘customTag' attribute in versions up to, and including, 1.10.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the Bricks Builder (admin-only by default), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This becomes more of an issue when Bricks Builder access is granted to lower-privileged users.
CVE-2024-6482 2 Hamid-alinia-idehweb, Idehweb 2 Login With Phone Number, Login With Phone Number 2024-09-27 8.8 High
The Login with phone number plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.7.49. This is due to a lack of validation and missing capability check on user-supplied data in the 'lwp_update_password_action' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update their role to any other role, including Administrator. The vulnerability was partially patched in version 1.7.40. The login with phone number pro plugin was required to exploit the vulnerability in versions 1.7.40 - 1.7.49.