Search

Expected end of text, found '.' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (345219 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-41697 1 Priority-software 1 Priority 2024-09-03 6.1 Medium
Priority - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2024-41698 1 Priority-software 1 Priority 2024-09-03 4.3 Medium
Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-41699 1 Priority-software 1 Priority 2024-09-03 4.4 Medium
Priority – CWE-552: Files or Directories Accessible to External Parties
CVE-2024-41518 2 Feripro, Mecodia 2 Feripro, Feripro 2024-09-03 7.5 High
An Incorrect Access Control vulnerability in "/admin/programm/<program_id>/export/statistics" in Feripro <= v2.2.3 allows remote attackers to export an XLSX file with information about registrations and participants.
CVE-2024-41700 1 Barix 2 Sip Client Firmware, Sip Client Web Management Interface Ui 2024-09-03 7.5 High
Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-42941 1 Tenda 2 Fh1201, Fh1201 Firmware 2024-09-03 7.5 High
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the wanmode parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2024-42940 1 Tenda 2 Fh1201, Fh1201 Firmware 2024-09-03 5.7 Medium
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2024-41241 2 Kashipara, Lopalopa 2 Responsive School Management System, Responsive School Management System 2024-09-03 4.8 Medium
A Reflected Cross Site Scripting (XSS) vulnerability was found in " /smsa/admin_login.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via "error" parameter.
CVE-2024-40473 2 Mayurik, Sourcecodester 2 Best House Rental Management System, Best House Rental Management System 2024-09-03 5.4 Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in "manage_houses.php" in SourceCodester Best House Rental Management System v1.0. It allows remote attackers to execute arbitrary code via "House_no" and "Description" parameter fields.
CVE-2024-42948 1 Tenda 2 Fh1201, Fh1201 Firmware 2024-09-03 7.5 High
Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2024-42568 1 Arajajyothibabu 1 School Management System 2024-09-03 9.8 Critical
School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the transport parameter at vehicle.php.
CVE-2024-44778 1 Vtiger 1 Vtiger Crm 2024-09-03 7.4 High
A reflected cross-site scripting (XSS) vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-44779 1 Vtiger 1 Vtiger Crm 2024-09-03 7.4 High
A reflected cross-site scripting (XSS) vulnerability in the viewname parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-44777 1 Vtiger 1 Vtiger Crm 2024-09-03 7.4 High
A reflected cross-site scripting (XSS) vulnerability in the tag parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-43964 1 Dsgvo-for-wp 1 Dsgvo All In One For Wp 2024-09-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Michael Leithold DSGVO All in one for WP allows Stored XSS.This issue affects DSGVO All in one for WP: from n/a through 4.5.
CVE-2024-43396 1 Khoj 1 Khoj 2024-09-03 5.4 Medium
Khoj is an application that creates personal AI agents. The Automation feature allows a user to insert arbitrary HTML inside the task instructions, resulting in a Stored XSS. The q parameter for the /api/automation endpoint does not get correctly sanitized when rendered on the page, resulting in the ability of users to inject arbitrary HTML/JS. This vulnerability is fixed in 1.15.0.
CVE-2024-7619 2024-09-03 N/A
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability.
CVE-2024-7798 2 Oretnom23, Sourcecodester 2 Simple Online Bidding System, Simple Online Bidding System 2024-09-03 7.3 High
A vulnerability was found in SourceCodester Simple Online Bidding System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /simple-online-bidding-system/bidding/admin/ajax.php?action=login2. The manipulation of the argument username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-7814 2 Codeastro, Online Railway Reservation System Project 2 Online Railway Reservation System, Online Railway Reservation System 2024-09-03 2.4 Low
A vulnerability, which was classified as problematic, was found in CodeAstro Online Railway Reservation System 1.0. Affected is an unknown function of the file /admin/admin-add-employee.php of the component Add Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-7833 1 Dlink 2 Di-8100, Di-8100 Firmware 2024-09-03 6.3 Medium
A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter.asp. The manipulation of the argument path leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.