Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43440 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-28079 1 Jamovi 1 Jamovi 2024-11-21 6.1 Medium
Jamovi <=1.6.18 is affected by a cross-site scripting (XSS) vulnerability. The column-name is vulnerable to XSS in the ElectronJS Framework. An attacker can make a .omv (Jamovi) document containing a payload. When opened by victim, the payload is triggered.
CVE-2021-28054 1 Centreon 1 Centreon 2024-11-21 5.4 Medium
An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. A Stored Cross-Site Scripting (XSS) issue in "Configuration > Hosts" allows remote authenticated users to inject arbitrary web script or HTML via the Alias parameter.
CVE-2021-28047 1 Devolutions 1 Remote Desktop Manager 2024-11-21 5.4 Medium
Cross-Site Scripting (XSS) in Administrative Reports in Devolutions Remote Desktop Manager before 2021.1 allows remote authenticated users to inject arbitrary web script or HTML via multiple input fields.
CVE-2021-28007 1 Web Based Quiz System Project 1 Web Based Quiz System 2024-11-21 6.1 Medium
Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in register.php through the name parameter.
CVE-2021-28006 1 Web Based Quiz System Project 1 Web Based Quiz System 2024-11-21 6.1 Medium
Web Based Quiz System 1.0 is affected by cross-site scripting (XSS) in admin.php through the options parameter.
CVE-2021-28002 1 Textpattern 1 Textpattern 2024-11-21 5.4 Medium
A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page.
CVE-2021-28001 1 Textpattern 1 Textpattern 2024-11-21 5.4 Medium
A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting https://site.com/articles/welcome-to-your-site#comments-head.
CVE-2021-28000 1 Local Services Search Engine Management System Project 1 Local Services Search Engine Management System 2024-11-21 4.8 Medium
A persistent cross-site scripting vulnerability was discovered in Local Services Search Engine Management System Project 1.0 which allows remote attackers to execute arbitrary code via crafted payloads entered into the Name and Address fields.
CVE-2021-27989 1 Appspace 1 Appspace 2024-11-21 5.4 Medium
Appspace 6.2.4 is vulnerable to stored cross-site scripting (XSS) in multiple parameters within /medianet/sgcontentset.aspx.
CVE-2021-27969 1 Boonex 1 Dolphin 2024-11-21 4.8 Medium
Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder "width" parameter.
CVE-2021-27956 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 6.1 Medium
Zoho ManageEngine ADSelfService Plus before 6104 allows stored XSS on the /webclient/index.html#/directory-search user search page via the e-mail address field.
CVE-2021-27952 1 Ecobee 2 Ecobee3 Lite, Ecobee3 Lite Firmware 2024-11-21 9.8 Critical
Hardcoded default root credentials exist on the ecobee3 lite 4.5.81.200 device. This allows a threat actor to gain access to the password-protected bootloader environment through the serial console.
CVE-2021-27949 1 Mybb 1 Mybb 2024-11-21 6.1 Medium
Cross-site Scripting vulnerability in MyBB before 1.8.26 via Custom moderator tools.
CVE-2021-27945 1 Squirro 1 Squirro 2024-11-21 6.1 Medium
The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting (XSS) vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who views the relevant application content. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials, performing arbitrary actions on their behalf, and logging their keystrokes.
CVE-2021-27940 1 Openark 1 Orchestrator 2024-11-21 6.1 Medium
resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
CVE-2021-27938 1 Symbiote 1 Silverstripe Queued Jobs 2024-11-21 6.1 Medium
A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
CVE-2021-27933 1 Pfsense 1 Pfsense 2024-11-21 6.1 Medium
pfSense 2.5.0 allows XSS via the services_wol_edit.php Description field.
CVE-2021-27930 1 Irislink 1 Irisnext 2024-11-21 5.4 Medium
Multiple stored XSS vulnerabilities in IrisNext Edition 9.5.16, which allows an authenticated (or compromised) user to inject malicious JavaScript in folder/file name within the application in order to grab other users’ sessions or execute malicious code in their browsers (1-click RCE).
CVE-2021-27914 1 Acquia 1 Mautic 2024-11-21 7.6 High
A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript
CVE-2021-27912 1 Acquia 1 Mautic 2024-11-21 7.1 High
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.