Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (42960 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2018-10817 1 Severalnines 1 Clustercontrol 2024-11-21 N/A
Severalnines ClusterControl before 1.6.0-4699 allows XSS.
CVE-2018-10813 1 Aprendecondedos 1 Dedos-web 2024-11-21 N/A
In Dedos-web 1.0, the cookie and session secrets used in the Express.js application have hardcoded values that are visible in the source code published on GitHub. An attacker can edit the contents of the session cookie and re-sign it using the hardcoded secret. Due to the use of Passport.js, this could lead to privilege escalation.
CVE-2018-10810 1 Livezilla 1 Livezilla 2024-11-21 N/A
chat/mobile/index.php in LiveZilla Live Chat 7.0.9.5 and prior is affected by Cross-Site Scripting via the Accept-Language HTTP header.
CVE-2018-10806 1 Frogcms Project 1 Frogcms 2024-11-21 N/A
An issue was discovered in Frog CMS 0.9.5. There is a reflected Cross Site Scripting Vulnerability via the file[current_name] parameter to the admin/?/plugin/file_manager/rename URI. This can be used in conjunction with CSRF.
CVE-2018-10803 1 Zohocorp 1 Manageengine Netflow Analyzer 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the add credentials functionality in Zoho ManageEngine NetFlow Analyzer v12.3 before 12.3.125 (build 123125) allows remote attackers to inject arbitrary web script or HTML via a crafted description value. This can be exploited through CSRF.
CVE-2018-10763 1 Synametrics 1 Synaman 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Synametrics SynaMan 4.0 build 1488 via the (1) Main heading or (2) Sub heading fields in the Partial Branding configuration page.
CVE-2018-10752 1 Tagregator Project 1 Tagregator 2024-11-21 N/A
The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.
CVE-2018-10727 1 Fabrikar 1 Fabrik 2024-11-21 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in the fabrik_referrer hidden field in the Fabrikar Fabrik component through v3.8.1 for Joomla! allows remote attackers to inject arbitrary web script via the HTTP Referer header.
CVE-2018-10726 1 Datenstrom 1 Yellow 2024-11-21 5.4 Medium
A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS
CVE-2018-10723 1 Rangerstudio 1 Directus 2024-11-21 N/A
Directus 6.4.9 has a hardcoded admin password for the Admin account because of an INSERT statement in api/schema.sql.
CVE-2018-10704 1 Yii2cmf Project 1 Yii2cmf 2024-11-21 6.1 Medium
yidashi yii2cmf 2.0 has XSS via the /search q parameter.
CVE-2018-10700 1 Moxa 2 Awk-3121, Awk-3121 Firmware 2024-11-21 N/A
An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However, the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter "iw_board_deviceName" is susceptible to this injection.
CVE-2018-10692 1 Moxa 2 Awk-3121, Awk-3121 Firmware 2024-11-21 N/A
An issue was discovered on Moxa AWK-3121 1.14 devices. The session cookie "Password508" does not have an HttpOnly flag. This allows an attacker who is able to execute a cross-site scripting attack to steal the cookie very easily.
CVE-2018-10686 1 Vestacp 1 Control Panel 2024-11-21 N/A
An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST['path'] to the view/file/index.php URI, which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.
CVE-2018-10680 1 Zblogcn 1 Z-blogphp 2024-11-21 N/A
Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to "Web site settings --> Basic setting --> Website title" and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance, noting it is "just a functional bug.
CVE-2018-10665 1 Ilias 1 Ilias 2024-11-21 N/A
ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, related to shib_logout.php and third-party demo files.
CVE-2018-10649 1 Citrix 1 Xenmobile Server 2024-11-21 N/A
There is a Cross-Site Scripting Vulnerability in Citrix XenMobile Server 10.7 before RP3.
CVE-2018-10633 1 Universal-robots 2 Cb3.1, Cb3.1 Firmware 2024-11-21 N/A
Universal Robots Robot Controllers Version CB 3.1, SW Version 3.4.5-100 utilizes hard-coded credentials that may allow an attacker to reset passwords for the controller.
CVE-2018-10609 1 Martem 4 Telem-gw6, Telem-gw6 Firmware, Telem-gwm and 1 more 2024-11-21 N/A
Martem TELEM GW6 and GWM devices with firmware 2018.04.18-linux_4-01-601cb47 and prior allow improper sanitization of data over a Websocket which may allow cross-site scripting and client-side code execution with target user privileges.
CVE-2018-10592 1 Yokogawa 8 Fcj, Fcj Firmware, Fcn-100 and 5 more 2024-11-21 N/A
Yokogawa STARDOM FCJ controllers R4.02 and prior, FCN-100 controllers R4.02 and prior, FCN-RTU controllers R4.02 and prior, and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device, which could result in remote code execution.