Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (334510 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-20437 1 Cisco 1 Ios Xe 2024-10-24 8.1 High
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack and execute commands on the CLI of an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an already authenticated user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
CVE-2024-50050 1 Meta Platforms Inc 1 Llama Stack 2024-10-24 6.3 Medium
Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.
CVE-2024-46937 1 Mfasoft 1 Secure Authentication Server 2024-10-24 9.1 Critical
An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.
CVE-2024-49326 1 Vasiliskerasiotis 1 Affiliator 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Vasilis Kerasiotis Affiliator allows Upload a Web Shell to a Web Server.This issue affects Affiliator: from n/a through 2.1.3.
CVE-2024-49324 1 Sovratec 2 Case Management, Sovratec Case Management 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Sovratec Sovratec Case Management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through 1.0.0.
CVE-2024-49327 1 Asepbagjapriandana 1 Woostagram Connect 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Asep Bagja Priandana Woostagram Connect allows Upload a Web Shell to a Web Server.This issue affects Woostagram Connect: from n/a through 1.0.2.
CVE-2024-49329 2 Vivek Tamrakar, Vivektamrakar 2 Wp Rest Api Fns, Wp Rest Api Fns 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Vivek Tamrakar WP REST API FNS allows Upload a Web Shell to a Web Server.This issue affects WP REST API FNS: from n/a through 1.0.0.
CVE-2024-49330 1 Brx8r 1 Nice Backgrounds 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in brx8r Nice Backgrounds allows Upload a Web Shell to a Web Server.This issue affects Nice Backgrounds: from n/a through 1.0.
CVE-2024-49331 2 Myriad Solutionz, Myriadsolutionz 2 Property Lot Management System, Property Lot Management System 2024-10-24 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through 4.2.38.
CVE-2024-49332 2 Giveaway Boost, Giveawayboost 2 Giveaway Boost, Giveaway Boost 2024-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4.
CVE-2024-49607 2 Redwan Hilali, Redwanhilali 2 Wp Dropbox Dropins, Wp Dropbox Dropins 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Redwan Hilali WP Dropbox Dropins allows Upload a Web Shell to a Web Server.This issue affects WP Dropbox Dropins: from n/a through 1.0.
CVE-2024-49608 1 Gerryntabuhashe 1 Gerryworks Post By Mail 2024-10-24 8.8 High
: Incorrect Privilege Assignment vulnerability in Gerry Ntabuhashe GERRYWORKS Post by Mail allows Privilege Escalation.This issue affects GERRYWORKS Post by Mail: from n/a through 1.0.
CVE-2024-49610 2 Jack Zhu, Jackzhu 2 Photokit, Photokit 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Jack Zhu allows Upload a Web Shell to a Web Server.This issue affects photokit: from n/a through 1.0.
CVE-2024-49621 1 Apa 1 Apa Register Newsletter Form 2024-10-24 8.2 High
Cross-Site Request Forgery (CSRF) vulnerability in Apa APA Register Newsletter Form allows SQL Injection.This issue affects APA Register Newsletter Form: from n/a through 1.0.0.
CVE-2024-49612 1 Infotuts 1 Sw Contact Form 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infotuts SW Contact Form allows Blind SQL Injection.This issue affects SW Contact Form: from n/a through 1.0.
CVE-2024-49609 1 Brandonwhite 1 Author Discussion 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Brandon White Author Discussion allows Blind SQL Injection.This issue affects Author Discussion: from n/a through 0.2.2.
CVE-2024-49605 1 Avchat.net 1 Avchat Video Chat 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2.
CVE-2024-49335 1 Edush Maxim 1 Googledrive Folder List 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2.
CVE-2024-47325 1 Themeisle 1 Multiple Page Generator 2024-10-24 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Multiple Page Generator Plugin – MPG allows SQL Injection.This issue affects Multiple Page Generator Plugin – MPG: from n/a through 3.4.7.
CVE-2024-48657 2 Itsourcecode, Princelycesar 2 Hospital Management System, Hospital Management System 2024-10-24 8.1 High
SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.