Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (329599 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-4242 1 Phpgurukul 1 Online Birth Certificate System 2025-05-09 7.3 High
A vulnerability classified as critical was found in PHPGurukul Online Birth Certificate System 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/between-dates-report.php. The manipulation of the argument fromdate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVE-2025-4309 1 Phpgurukul 1 Art Gallery Management System 2025-05-09 7.3 High
A vulnerability was found in PHPGurukul Art Gallery Management System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/add-art-type.php. The manipulation of the argument arttype leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-49334 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.
CVE-2023-49333 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.
CVE-2024-21791 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 4.7 Medium
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection in lockout history option. Note: Non-admin users cannot exploit this vulnerability.
CVE-2023-49335 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.
CVE-2023-49332 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.
CVE-2023-49331 1 Zohocorp 1 Manageengine Adaudit Plus 2025-05-09 8.3 High
Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.
CVE-2024-1290 1 Strategy11 1 User Registration Forms 2025-05-09 6.5 Medium
The User Registration WordPress plugin before 2.12 does not prevent users with at least the contributor role from rendering sensitive shortcodes, allowing them to generate, and leak, valid password reset URLs, which they can use to take over any accounts.
CVE-2025-1232 1 Geminilabs 1 Site Reviews 2025-05-09 8.8 High
The Site Reviews WordPress plugin before 7.2.5 does not properly sanitise and escape some of its Review fields, which could allow unauthenticated users to perform Stored XSS attacks
CVE-2024-45027 1 Linux 1 Linux Kernel 2025-05-09 5.5 Medium
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup() If xhci_mem_init() fails, it calls into xhci_mem_cleanup() to mop up the damage. If it fails early enough, before xhci->interrupters is allocated but after xhci->max_interrupters has been set, which happens in most (all?) cases, things get uglier, as xhci_mem_cleanup() unconditionally derefences xhci->interrupters. With prejudice. Gate the interrupt freeing loop with a check on xhci->interrupters being non-NULL. Found while debugging a DMA allocation issue that led the XHCI driver on this exact path.
CVE-2025-4475 2025-05-08 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-4107 2025-05-08 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-26559 1 Dagg 1 Uverif 2025-05-08 5.3 Medium
An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.
CVE-2022-36677 1 Lynchjames 1 Obsidian Mind Map 2025-05-08 6.1 Medium
Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.
CVE-2023-27151 1 Opencrx 1 Opencrx 2025-05-08 6.1 Medium
openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) via the Name, Description, or Activity Number field.
CVE-2023-51774 1 Json-jwt Project 1 Json-jwt 2025-05-08 8.4 High
The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode.
CVE-2024-25006 1 Xenforo 1 Xenforo 2025-05-08 8.1 High
XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and uses a ZIP archive for Styles Import.
CVE-2022-43424 1 Jenkins 2 Compuware Xpediter Code Coverage, Jenkins 2025-05-08 5.3 Medium
Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.
CVE-2022-41415 1 Acer 2 Altos W2000h-w570h F4, Altos W2000h-w570h F4 Firmware 2025-05-08 9.8 Critical
Acer Altos W2000h-W570h F4 R01.03.0018 was discovered to contain a stack overflow in the RevserveMem component. This vulnerability allows attackers to cause a Denial of Service (DoS) via injecting crafted shellcode into the NVRAM variable.