Search

Expected end of text, found '.' (at char 12), (line:1, col:13)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (345062 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-7937 2 Itsourcecode, Project Expense Monitoring System Project 2 Project Expense Monitoring System, Project Expense Monitoring System 2024-09-03 6.3 Medium
A vulnerability classified as critical was found in itsourcecode Project Expense Monitoring System 1.0. This vulnerability affects unknown code of the file printtransfer.php. The manipulation of the argument transfer_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-7942 2 Rems, Sourcecodester 2 Leads Manager Tool, Leads Manager Tool 2024-09-03 3.5 Low
A vulnerability has been found in SourceCodester Leads Manager Tool 1.0 and classified as problematic. This vulnerability affects unknown code of the file update-leads.php. The manipulation of the argument phone_number leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-7943 2 Adonesevangelista, Itsourcecode 2 Laravel Property Management System, Laravel Property Management System 2024-09-03 6.3 Medium
A vulnerability was found in itsourcecode Laravel Property Management System 1.0 and classified as critical. This issue affects the function upload of the file PropertiesController.php. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-41697 1 Priority-software 1 Priority 2024-09-03 6.1 Medium
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-41698 1 Priority-software 1 Priority 2024-09-03 4.3 Medium
Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-41699 1 Priority-software 1 Priority 2024-09-03 4.4 Medium
Priority – CWE-552: Files or Directories Accessible to External Parties
CVE-2024-41518 2 Feripro, Mecodia 2 Feripro, Feripro 2024-09-03 7.5 High
An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX file with information about registrations and participants.
CVE-2024-41700 1 Barix 2 Sip Client Firmware, Sip Client Web Management Interface Ui 2024-09-03 7.5 High
Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-42941 1 Tenda 2 Fh1201, Fh1201 Firmware 2024-09-03 7.5 High
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2024-42940 1 Tenda 2 Fh1201, Fh1201 Firmware 2024-09-03 5.7 Medium
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2024-41241 2 Kashipara, Lopalopa 2 Responsive School Management System, Responsive School Management System 2024-09-03 4.8 Medium
A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
CVE-2024-40473 2 Mayurik, Sourcecodester 2 Best House Rental Management System, Best House Rental Management System 2024-09-03 5.4 Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote attackers to execute arbitrary code via "House_no" and "Description" parameter fields.
CVE-2024-42948 1 Tenda 2 Fh1201, Fh1201 Firmware 2024-09-03 7.5 High
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2024-42568 1 Arajajyothibabu 1 School Management System 2024-09-03 9.8 Critical
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.
CVE-2024-44778 1 Vtiger 1 Vtiger Crm 2024-09-03 7.4 High
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-44779 1 Vtiger 1 Vtiger Crm 2024-09-03 7.4 High
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-44777 1 Vtiger 1 Vtiger Crm 2024-09-03 7.4 High
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-43964 1 Dsgvo-for-wp 1 Dsgvo All In One For Wp 2024-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a through 4.5.
CVE-2024-43396 1 Khoj 1 Khoj 2024-09-03 5.4 Medium
Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.
CVE-2024-7619 2024-09-03 N/A
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.