Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43886 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-34025 1 Vestacp 1 Vesta Control Panel 2024-11-21 6.1 Medium
Vesta v1.0.0-5 was discovered to contain a cross-site scripting (XSS) vulnerability via the post function at /web/api/v1/upload/UploadHandler.php.
CVE-2022-34009 2 Fossil-scm, Microsoft 2 Fossil, Windows 2024-11-21 5.5 Medium
Fossil 2.18 on Windows allows attackers to cause a denial of service (daemon crash) via an XSS payload in a ticket. This occurs because the ticket data is stored in a temporary file, and the product does not properly handle the absence of this file after Windows Defender has flagged it as malware.
CVE-2022-34007 1 Eqs 1 Integrity Line 2024-11-21 6.1 Medium
EQS Integrity Line Professional through 2022-07-01 allows a stored XSS via a crafted whistleblower entry.
CVE-2022-34005 1 Southrivertech 1 Titan Ftp Server Nextgen 2024-11-21 9.8 Critical
An issue was discovered in TitanFTP (aka Titan FTP) NextGen before 1.2.1050. There is Remote Code Execution due to a hardcoded password for the sa account on the Microsoft SQL Express 2019 instance installed by default during TitanFTP NextGen installation, aka NX-I674 (sub-issue 1). NOTE: as of 2022-06-21, the 1.2.1050 release corrects this vulnerability in a new installation, but not in an upgrade installation.
CVE-2022-33994 1 Gutenberg Project 1 Gutenberg 2024-11-21 3.0 Low
The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS payload does not execute in the context of the WordPress instance's domain; however, analogous attempts by low-privileged users to reference SVG documents are blocked by some similar products, and this behavioral difference might have security relevance to some WordPress site administrators.
CVE-2022-33935 1 Dell 1 Emc Data Protection Advisor 2024-11-21 5.4 Medium
Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVE-2022-33929 1 Dell 1 Wyse Management Suite 2024-11-21 6.1 Medium
Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in EndUserSummary page. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVE-2022-33910 1 Mantisbt 1 Mantisbt 2024-11-21 5.4 Medium
An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute.
CVE-2022-33157 1 Libconnect Project 1 Libconnect 2024-11-21 6.1 Medium
The libconnect extension before 7.0.8 and 8.x before 8.1.0 for TYPO3 allows XSS.
CVE-2022-33156 1 Matomo 1 Integration 2024-11-21 6.1 Medium
The matomo_integration (aka Matomo Integration) extension before 1.3.2 for TYPO3 allows XSS.
CVE-2022-33155 1 Ameos Tarteaucitron Project 1 Ameos Tarteaucitron 2024-11-21 5.4 Medium
The ameos_tarteaucitron (aka AMEOS - TarteAuCitron GDPR cookie banner and tracking management / French RGPD compatible) extension before 1.2.23 for TYPO3 allows XSS.
CVE-2022-33154 1 Schema Project 1 Schema 2024-11-21 5.4 Medium
The schema (aka Embedding schema.org vocabulary) extension before 1.13.1 and 2.x before 2.5.1 for TYPO3 allows XSS.
CVE-2022-33151 1 Cybozu 1 Office 2024-11-21 6.1 Medium
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows remote attackers to inject an arbitrary script via unspecified vectors.
CVE-2022-33122 1 Eyoucms 1 Eyoucms 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL field under the login page.
CVE-2022-33119 1 Nuuo 2 Nvrsolo, Nvrsolo Firmware 2024-11-21 6.1 Medium
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
CVE-2022-33113 1 Jflyfox 1 Jfinal Cms 2024-11-21 5.4 Medium
Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
CVE-2022-33098 1 Magnolia-cms 1 Magnolia Cms 2024-11-21 6.1 Medium
Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2022-33075 1 Phpgurukul 1 Zoo Management System 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Add Classification function of Zoo Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via unspecified vectors.
CVE-2022-33043 1 Urtracker 1 Urtracker 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in the batch add function of Urtracker Premium v4.0.1.1477 allows attackers to execute arbitrary web scripts or HTML via a crafted excel file.
CVE-2022-33009 1 Lightcms Project 1 Lightcms 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in LightCMS v1.3.11 allows attackers to execute arbitrary web scripts or HTML via uploading a crafted PDF file.