Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43370 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-23181 1 Appleple 1 A-blog Cms 2025-06-20 6.1 Medium
Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50, and Ver.2.9.0 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the logged-in user's web browser.
CVE-2024-23032 1 Eyoucms 1 Eyoucms 2025-06-20 6.1 Medium
Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
CVE-2024-22635 1 Webcalendar Project 1 Webcalendar 2025-06-20 6.1 Medium
WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/edit_entry.php.
CVE-2024-22570 1 Njtech 1 Greencms 2025-06-20 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2023-7089 1 Benjaminzekavica 1 Easy Svg Support 2025-06-20 5.4 Medium
The Easy SVG Allow WordPress plugin through 1.0 does not sanitize uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.
CVE-2023-6278 1 Biteship 1 Biteship 2025-06-20 6.1 Medium
The Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo WordPress plugin before 2.2.25 does not sanitise and escape the biteship_error and biteship_message parameters before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2023-37571 1 Softing 1 Th Scope 2025-06-20 6.1 Medium
Softing TH SCOPE through 3.70 allows XSS.
CVE-2023-33758 1 Splicecom 1 Maximiser Soft Pbx 2025-06-20 6.1 Medium
Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DEVICE_GUID fields in the login component.
CVE-2021-43635 1 Codexnotes 1 Codex 2025-06-20 6.1 Medium
A Cross Site Scripting (XSS) vulnerability exists in Codex before 1.4.0 via Notebook/Page name field, which allows malicious users to execute arbitrary code via a crafted http code in a .json file.
CVE-2024-22549 1 Flycms Project 1 Flycms 2025-06-20 5.4 Medium
FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section.
CVE-2024-0606 1 Mozilla 1 Firefox Focus 2025-06-20 6.1 Medium
An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to unauthorized actions within the user's loaded webpage. This vulnerability affects Focus for iOS < 122.
CVE-2023-52330 1 Trendmicro 1 Apex One 2025-06-20 6.1 Medium
A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installations of Trend Micro Apex Central. Please note: user interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
CVE-2023-51946 1 Actidata 2 Actinas Sl 2u-8 Rdx, Actinas Sl 2u-8 Rdx Firmware 2025-06-20 6.1 Medium
Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to inject arbitrary web script or HTML.
CVE-2023-41176 1 Trendmicro 1 Mobile Security 2025-06-20 6.1 Medium
Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41177.
CVE-2024-31651 1 Oretnom23 1 Cosmetics And Beauty Product Online Store 2025-06-20 6.1 Medium
A cross-site scripting (XSS) in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVE-2024-55224 1 Dani-garcia 1 Vaultwarden 2025-06-20 9.6 Critical
An HTML injection vulnerability in Vaultwarden prior to v1.32.5 allows attackers to execute arbitrary code via injecting a crafted payload into the username field of an e-mail message.
CVE-2024-37776 1 Sunbirddcim 1 Dctrack 2025-06-20 4.8 Medium
A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in some admin screens.
CVE-2024-22714 1 Codelyfe 1 Stupid Simple Cms 2025-06-20 6.1 Medium
Stupid Simple CMS <=1.2.4 is vulnerable to Cross Site Scripting (XSS) in the editing section of the article content.
CVE-2024-0233 1 Myeventon 1 Eventon 2025-06-20 6.1 Medium
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not properly sanitise and escape a parameter before outputting it back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2023-7084 1 Davidjmiller 1 Voting Record 2025-06-20 5.4 Medium
The Voting Record WordPress plugin through 2.0 is missing sanitisation as well as escaping, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks