Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328890 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-42788 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2025-05-06 6.1 Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_music" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields.
CVE-2024-42791 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2025-05-06 8.8 High
A Cross-Site Request Forgery (CSRF) vulnerability was found in Kashipara Music Management System v1.0 via /music/ajax.php?action=delete_genre.
CVE-2024-42787 2 Kashipara, Lopalopa 2 Music Management System, Music Management System 2025-05-06 6.1 Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in "/music/ajax.php?action=save_playlist" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "description" parameter fields.
CVE-2024-42765 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 9.8 Critical
A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.
CVE-2024-42764 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 9.4 Critical
Kashipara Bus Ticket Reservation System v1.0 is vulnerable to Cross Site Request Forgery (CSRF) via /deleteTicket.php.
CVE-2024-42762 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 5.4 Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in "/history.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the Name, Phone, and Email parameter fields.
CVE-2024-42763 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 5.4 Medium
A Reflected Cross Site Scripting (XSS) vulnerability was found in the "/schedule.php" page of the Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via the "bookingdate" parameter.
CVE-2024-42761 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 6.1 Medium
A Stored Cross Site Scripting (XSS) vulnerability was found in "/admin_schedule.php" in Kashipara Bus Ticket Reservation System v1.0, which allows remote attackers to execute arbitrary code via scheduleDurationPHP parameter.
CVE-2025-3488 1 Wpml 1 Wpml 2025-05-06 6.4 Medium
The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_switcher shortcode in versions 3.6.0 - 4.7.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-50839 2 Kashipara, Lopalopa 2 E Learning Management System Project, E-learning Management System 2025-05-06 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add_subject.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the subject_code and title parameters.
CVE-2024-50840 2 Kashipara, Lopalopa 2 E Learning Management System Project, E-learning Management System 2025-05-06 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the class_name parameter.
CVE-2024-50841 2 Kashipara, Lopalopa 2 E Learning Management System Project, E-learning Management System 2025-05-06 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the date_start, date_end, and title parameters.
CVE-2024-50842 2 Kashipara, Lopalopa 2 E Learning Management System Project, E-learning Management System 2025-05-06 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the school_year parameter.
CVE-2024-50837 2 Kashipara, Lopalopa 2 E Learning Management System Project, E-learning Management System 2025-05-06 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin_user.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and username parameters.
CVE-2024-50838 2 Kashipara, Lopalopa 2 E Learning Management System Project, E-learning Management System 2025-05-06 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the d and pi parameters.
CVE-2024-23527 1 Ivanti 1 Avalanche 2025-05-06 7.5 High
An out-of-bounds read vulnerability in WLAvalancheService component of Ivanti Avalanche before 6.4.3, in certain conditions can allow an unauthenticated remote attacker to read sensitive information in memory.
CVE-2024-2328 1 Devowl 1 Real Media Library 2025-05-06 6.4 Medium
The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to, and including, 4.22.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2018-1359 2025-05-06 N/A
Not used
CVE-2024-22778 1 Hackmd 1 Codimd 2025-05-06 7.5 High
HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.
CVE-2025-47303 2025-05-06 N/A
Not used