Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (324440 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-49778 1 Dmry 1 Sayfa Sayac 2025-04-24 10 Critical
Deserialization of Untrusted Data vulnerability in Hakan Demiray Sayfa Sayac.This issue affects Sayfa Sayac: from n/a through 2.6.
CVE-2023-50822 1 Currencywiki 1 Currency Converter Widget - Exchange Rates 2025-04-24 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Currency.Wiki Currency Converter Widget – Exchange Rates allows Stored XSS.This issue affects Currency Converter Widget – Exchange Rates: from n/a through 3.0.2.
CVE-2023-32747 1 Automattic 1 Woocommerce Bookings 2025-04-24 5.4 Medium
Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Bookings.This issue affects WooCommerce Bookings: from n/a through 1.15.78.
CVE-2023-7039 1 Byzoro 2 Smart S210, Smart S210 Firmware 2025-04-24 6.3 Medium
A vulnerability classified as critical has been found in Byzoro S210 up to 20231210. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248688.
CVE-2024-7263 2 Kingsoft, Microsoft 2 Wps Office, Windows 2025-04-24 7.8 High
Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 (exclusive) on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough. Another parameter was not properly sanitized which leads to the execution of an arbitrary Windows library.
CVE-2023-20249 1 Cisco 1 Telepresence Management Suite 2025-04-24 5.4 Medium
A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by inserting malicious data in a specific data field in the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
CVE-2023-36645 1 Itb-pim 1 Tradepro 2025-04-24 9.1 Critical
SQL injection vulnerability in ITB-GmbH TradePro v9.5, allows remote attackers to run SQL queries via oordershow component in customer function.
CVE-2023-36644 1 Itb-pim 1 Tradepro 2025-04-24 7.5 High
Incorrect Access Control in ITB-GmbH TradePro v9.5, allows remote attackers to receive all order confirmations from the online shop via the printmail plugin.
CVE-2023-26686 1 Cs-cart 1 Cs-cart Multivendor 2025-04-24 9.8 Critical
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the image upload feature when customizing a shop.
CVE-2023-26687 1 Cs-cart 1 Cs-cart Multivendor 2025-04-24 8.8 High
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to obtain sensitive information via the product_data parameter in the PDF Add-on.
CVE-2023-26688 1 Cs-cart 1 Cs-cart Multivendor 2025-04-24 5.4 Medium
Cross Site Scripting (XSS) vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via the product_data parameter of add/edit product in the administration interface.
CVE-2023-26689 1 Cs-cart 1 Cs-cart Multivendor 2025-04-24 9.8 Critical
An issue discovered in CS-Cart MultiVendor 4.16.1 allows attackers to alter arbitrary user account profiles via crafted post request.
CVE-2023-26690 1 Cs-cart 1 Cs-cart Multivendor 2025-04-24 8.8 High
File Upload vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via File Manager/Editor component in the vendor or admin menu.
CVE-2023-26691 1 Cs-cart 1 Cs-cart Multivendor 2025-04-24 7.2 High
Directory Traversal vulnerability in CS-Cart MultiVendor 4.16.1 allows remote attackers to run arbitrary code via crafted zip file when installing a new add-on.
CVE-2024-49995 1 Redhat 1 Enterprise Linux 2025-04-24 7.1 High
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2022-46414 1 Veritas 2 Access Appliance, Netbackup Flex Scale Appliance 2025-04-24 9.8 Critical
An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur via the management portal.
CVE-2022-45990 1 Ecommerce-website Project 1 Ecommerce-website 2025-04-24 6.1 Medium
A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the eMail parameter.
CVE-2022-45912 1 Zimbra 1 Collaboration 2025-04-24 7.2 High
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution.
CVE-2022-45771 1 Pwndoc Project 1 Pwndoc 2025-04-24 8.8 High
An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file.
CVE-2022-45769 1 Clicshopping 1 Clicshopping V3 2025-04-24 6.1 Medium
A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter.