Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44222 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-34734 1 Secnet 1 Annet Ac Centralized Management Platform 2024-11-27 4.8 Medium
Annet AC Centralized Management Platform 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS) .
CVE-2023-50924 1 Engelsystem 1 Engelsystem 2024-11-27 7.3 High
Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user's context. This vulnerability enables an authenticated user to inject Javascript into other user's sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.
CVE-2023-36146 1 Multilaser 2 Re170, Re170 Firmware 2024-11-27 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability was found in Multilaser RE 170 using firmware 2.2.6733.
CVE-2023-37298 1 Joplin Project 1 Joplin 2024-11-27 6.1 Medium
Joplin before 2.11.5 allows XSS via a USE element in an SVG document.
CVE-2023-37299 1 Joplin Project 1 Joplin 2024-11-27 6.1 Medium
Joplin before 2.11.5 allows XSS via an AREA element of an image map.
CVE-2023-49119 1 Weseek 1 Growi 2024-11-27 5.4 Medium
Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.
CVE-2023-28474 1 Concretecms 1 Concrete Cms 2024-11-27 5.4 Medium
Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.
CVE-2023-33785 1 Netbox 1 Netbox 2024-11-27 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Create Rack Roles (/dcim/rack-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVE-2023-33795 1 Netbox 1 Netbox 2024-11-27 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Create Contact Roles (/tenancy/contact-roles/) function of Netbox v3.5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVE-2023-33661 1 Churchcrm 1 Churchcrm 2024-11-27 6.1 Medium
Multiple cross-site scripting (XSS) vulnerabilities were discovered in Church CRM v4.5.3 in GroupReports.php via GroupRole, ReportModel, and OnlyCart parameters.
CVE-2023-34647 1 Phpgurukul 1 Hostel Management System 2024-11-27 6.1 Medium
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-34650 1 Small Crm Project 1 Small Crm 2024-11-27 6.1 Medium
PHPgurukl Small CRM v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-34651 1 Hospital Management System Project 1 Hospital Management System 2024-11-27 6.1 Medium
PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-34652 1 Phpgurukul 1 Hostel Management System 2024-11-27 6.1 Medium
PHPgurukl Hostel Management System v.1.0 is vulnerable to Cross Site Scripting (XSS) via Add New Course.
CVE-2022-27665 1 Progress 1 Ws Ftp Server 2024-11-27 6.1 Medium
Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0. This can lead to execution of malicious code and commands on the client due to improper handling of user-provided input. By inputting malicious payloads in the subdirectory searchbar or Add folder filename boxes, it is possible to execute client-side commands. For example, there is Client-Side Template Injection via subFolderPath to the ThinClient/WtmApiService.asmx/GetFileSubTree URI.
CVE-2023-34831 1 Odysseycs 1 Ithacalabs Turnitin Lti 2024-11-27 5.4 Medium
The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form ("id" and "title" HTTP POST parameters) where the students submit their reports for similarity/plagiarism checks.
CVE-2024-10175 2024-11-27 6.4 Medium
The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wdo_pricing_tables shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-36484 1 Ilias 1 Ilias 2024-11-26 6.1 Medium
ILIAS 7.21 and 8.0_beta1 through 8.2 is vulnerable to reflected Cross-Site Scripting (XSS).
CVE-2023-33335 1 Sophos 1 Iview 2024-11-26 6.1 Medium
Cross Site Scripting (XSS) in Sophos Sophos iView (The EOL was December 31st 2020) in grpname parameter that allows arbitrary script to be executed.
CVE-2023-42325 1 Netgate 1 Pfsense 2024-11-26 5.4 Medium
Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.