Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43126 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-15230 1 Librenms 1 Librenms 2024-11-21 N/A
LibreNMS v1.54 has XSS in the Create User, Inventory, Add Device, Notifications, Alert Rule, Create Maintenance, and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account.
CVE-2019-15228 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 N/A
FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.
CVE-2019-15227 1 Getflightpath 1 Flightpath 2024-11-21 N/A
FlightPath 4.8.3 has XSS in the Content, Edit urgent message, and Users sections of the Admin Console. This could lead to cookie stealing and other malicious actions.
CVE-2019-15127 1 Vanderbilt 1 Redcap 2024-11-21 N/A
REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.
CVE-2019-15124 1 Mediawiki 1 Mobilefrontend 2024-11-21 6.1 Medium
In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33.
CVE-2019-15120 1 Kunena 1 Kunena 2024-11-21 5.4 Medium
The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.
CVE-2019-15112 1 Wp-slimstat 1 Slimstat Analytics 2024-11-21 6.1 Medium
The wp-slimstat plugin before 4.8.1 for WordPress has XSS.
CVE-2019-15110 1 Wp Front End Profile Project 1 Wp Front End Profile 2024-11-21 N/A
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.
CVE-2019-15109 1 Stellarwp 1 The Events Calendar 2024-11-21 N/A
The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.
CVE-2019-15108 1 Wso2 1 Api Manager 2024-11-21 4.8 Medium
An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component.
CVE-2019-15095 1 Diaowen 1 Dwsurvey 2024-11-21 N/A
DWSurvey through 2019-07-22 has reflected XSS via the design/qu-multi-fillblank!answers.action surveyId parameter.
CVE-2019-15086 1 Prise 1 Adas 2024-11-21 6.1 Medium
An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message.
CVE-2019-15083 1 Zohocorp 1 Manageengine Servicedesk Plus 2024-11-21 6.1 Medium
Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector, the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At "Asset Home > Server > <workstation> > software" the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field, a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.
CVE-2019-15082 1 Yofla 1 360 Product Rotation 2024-11-21 N/A
The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.
CVE-2019-15081 1 Opencart 1 Opencart 2024-11-21 4.8 Medium
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
CVE-2019-15075 1 Inextrix 1 Astpp 2024-11-21 7.5 High
An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.
CVE-2019-15074 1 Mantisbt 1 Mantisbt 2024-11-21 N/A
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
CVE-2019-15072 1 Openfind 1 Mail2000 2024-11-21 6.1 Medium
The login feature in "/cgi-bin/portal" in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via any parameter. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15071 1 Openfind 1 Mail2000 2024-11-21 6.1 Medium
The "/cgi-bin/go" page in MAIL2000 through version 6.0 and 7.0 has a cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code via ACTION parameter without authentication. The code can executed for any user accessing the page. This vulnerability affects many mail system of governments, organizations, companies and universities.
CVE-2019-15054 1 Getmailbird 1 Mailbird 2024-11-21 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context via a crafted HTML mail message. This vulnerability is distinct from CVE-2015-4657.