Search

Expected end of text, found '.' (at char 16), (line:1, col:17)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (331558 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-45444 1 Huawei 2 Emui, Harmonyos 2024-09-06 5.5 Medium
Access permission verification vulnerability in the WMS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-45443 1 Huawei 2 Emui, Harmonyos 2024-09-06 6.1 Medium
Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.
CVE-2024-45392 1 Salesagility 1 Suitecrm 2024-09-06 7.7 High
SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue.
CVE-2024-44728 2 Angeljudesuarez, Sourcecodehero 2 Event Management System, Event Management System 2024-09-06 7.6 High
Sourcecodehero Event Management System 1.0 allows Stored Cross-Site Scripting via parameters Full Name, Address, Email, and contact# in /clientdetails/admin/regester.php.
CVE-2024-44727 2 Angeljudesuarez, Sourcecodehero 2 Event Management System, Event Management System 2024-09-06 7.4 High
Sourcecodehero Event Management System1.0 is vulnerable to SQL Injection via the parameter 'username' in /event/admin/login.php.
CVE-2024-24759 1 Mindsdb 1 Mindsdb 2024-09-06 9.3 Critical
MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 23.12.4.2, a threat actor can bypass the server-side request forgery protection on the whole website with DNS Rebinding. The vulnerability can also lead to denial of service. Version 23.12.4.2 contains a patch.
CVE-2024-45098 1 Ibm 1 Aspera Faspex 2024-09-06 6.8 Medium
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
CVE-2024-45097 1 Ibm 1 Aspera Faspex 2024-09-06 5.9 Medium
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification.
CVE-2024-45096 1 Ibm 1 Aspera Faspex 2024-09-06 6.5 Medium
IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user with access to the package to obtain sensitive information through a directory listing.
CVE-2024-8473 1 Phpgurukul 1 Job Portal 2024-09-06 6.3 Medium
Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through user_email parameter in /jobportal/admin/login.php.
CVE-2024-8472 1 Phpgurukul 1 Job Portal 2024-09-06 6.3 Medium
Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through multiple parameters in /jobportal/index.php.
CVE-2024-8471 1 Phpgurukul 1 Job Portal 2024-09-06 6.3 Medium
Cross-Site Scripting (XSS) vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through JOBID and USERNAME parameters in /jobportal/process.php.
CVE-2024-8470 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/vacancy/controller.php, and retrieve all the information stored in it.
CVE-2024-8469 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/employee/index.php, and retrieve all the information stored in it.
CVE-2024-8468 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through search parameter in /jobportal/index.php, and retrieve all the information stored in it.
CVE-2024-8467 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through id parameter in /jobportal/admin/category/index.php, and retrieve all the information stored in it.
CVE-2024-8466 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through CATEGORY parameter in /jobportal/admin/category/controller.php, and retrieve all the information stored in it.
CVE-2024-8465 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through user_id parameter in /jobportal/admin/user/controller.php, and retrieve all the information stored in it.
CVE-2024-8464 1 Phpgurukul 1 Job Portal 2024-09-06 9.8 Critical
SQL injection vulnerability, by which an attacker could send a specially designed query through JOBREGID parameter in /jobportal/admin/applicants/controller.php, and retrieve all the information stored in it.
CVE-2024-7381 2 Infinitumform, Wordpress 2 Geo Controller, Geo Controller 2024-09-06 5.3 Medium
The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes available on the target site.