Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43339 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-35305 1 Gollum Project 1 Gollum 2024-11-21 6.1 Medium
Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
CVE-2020-35296 1 Thinkadmin 1 Thinkadmin 2024-11-21 7.5 High
ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access.
CVE-2020-35275 1 Coastercms 1 Coastercms 2024-11-21 5.4 Medium
Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application.
CVE-2020-35274 1 Dotcms 1 Dotcms 2024-11-21 4.8 Medium
DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS.
CVE-2020-35272 1 Employee Performance Evaluation System Project 1 Employee Performance Evaluation System 2024-11-21 4.8 Medium
Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Admin Portal in the Task and Description fields.
CVE-2020-35271 1 Employee Performance Evaluation System Project 1 Employee Performance Evaluation System 2024-11-21 4.8 Medium
Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Employees, First Name and Last Name fields.
CVE-2020-35262 1 Digisol 2 Dg-hr3400, Dg-hr3400 Firmware 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter.
CVE-2020-35261 1 Multi Restaurant Table Reservation System Project 1 Multi Restaurant Table Reservation System 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Restaurant Name field to /dashboard/profile.php.
CVE-2020-35252 1 Egavilanmedia 1 User Registration And Login System With Admin Panel 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.
CVE-2020-35249 1 Elkarbackup 1 Elkarbackup 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add client feature.
CVE-2020-35240 1 Fluxbb 1 Fluxbb 2024-11-21 4.8 Medium
FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.
CVE-2020-35228 1 Netgear 4 Gs116e, Gs116e Firmware, Jgs516pe and 1 more 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter.
CVE-2020-35206 1 Quest 1 Policy Authority For Unified Communications 2024-11-21 6.1 Medium
Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2020-35204 1 Quest 1 Policy Authority For Unified Communications 2024-11-21 6.1 Medium
Reflected XSS in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the PolicyAuthority/Common/FolderControl.jsp file via the unqID parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2020-35203 1 Quest 1 Policy Authority For Unified Communications 2024-11-21 6.1 Medium
Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2020-35202 1 Igniterealtime 1 Openfire 2024-11-21 5.4 Medium
Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.
CVE-2020-35201 1 Igniterealtime 1 Openfire 2024-11-21 5.4 Medium
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.
CVE-2020-35200 1 Igniterealtime 1 Openfire 2024-11-21 6.1 Medium
Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.
CVE-2020-35199 1 Igniterealtime 1 Openfire 2024-11-21 5.4 Medium
Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.
CVE-2020-35170 1 Dell 2 Powermax Os, Unisphere 2024-11-21 6.3 Medium
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.9, Dell EMC Unisphere for PowerMax versions prior to 9.0.2.16, and Dell EMC PowerMax OS 5978.221.221 and 5978.479.479 contain a Cross-Site Scripting (XSS) vulnerability. An authenticated malicious user may potentially exploit this vulnerability to inject javascript code and affect other authenticated users’ sessions.