Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43854 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-27546 1 Hcltech 2 Domino, Hcl Inotes 2024-11-21 8.3 High
HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.
CVE-2022-27545 1 Hcltech 1 Bigfix Platform 2024-11-21 4.6 Medium
BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
CVE-2022-27506 1 Citrix 26 Sd-wan 1000, Sd-wan 1000 Firmware, Sd-wan 110 and 23 more 2024-11-21 2.7 Low
Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
CVE-2022-27505 1 Citrix 24 Sd-wan 1000, Sd-wan 1000 Firmware, Sd-wan 110 and 21 more 2024-11-21 6.1 Medium
Reflected cross site scripting (XSS)
CVE-2022-27503 1 Citrix 1 Storefront Server 2024-11-21 6.1 Medium
Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9
CVE-2022-27496 1 Zero-channel Plus Project 1 Zero-channel Plus 2024-11-21 6.1 Medium
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
CVE-2022-27476 1 Newbee-mall Project 1 Newbee-mall 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.
CVE-2022-27475 1 Hotel Management System Project 1 Hotel Management System 2024-11-21 6.1 Medium
Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
CVE-2022-27462 1 Wwbn 1 Avideo 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
CVE-2022-27441 1 Tpcms Project 1 Tpcms 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box.
CVE-2022-27436 1 Ecommerce-website Project 1 Ecommerce-website 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field.
CVE-2022-27428 1 Gallerycms Project 1 Gallerycms 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in /index.php/album/add of GalleryCMS v2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the album_name parameter.
CVE-2022-27425 1 Chamilo 1 Chamilo 2024-11-21 6.1 Medium
Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
CVE-2022-27422 1 Chamilo 1 Chamilo Lms 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.
CVE-2022-27348 1 Socialcodia 1 Social Codia Sms 2024-11-21 4.8 Medium
Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.
CVE-2022-27330 1 E-commerce Website Project 1 E-commerce Website 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.
CVE-2022-27308 1 Phprojekt Phpsimplygest Project 1 Phprojekt Phpsimplygest 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in PHProjekt PhpSimplyGest v1.3.0 allows attackers to execute arbitrary web scripts or HTML via a project title.
CVE-2022-27280 1 Inhandnetworks 2 Inrouter 900, Inrouter 900 Firmware 2024-11-21 5.4 Medium
InHand Networks InRouter 900 Industrial 4G Router before v1.0.0.r11700 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the web_exec parameter at /apply.cgi.
CVE-2022-27258 1 Hubzilla 1 Hubzilla 2024-11-21 6.1 Medium
Multiple Cross-Site Scripting (XSS) vulnerabilities in Hubzilla 7.0.3 and earlier allows remote attacker to include arbitrary web script or HTML via the rpath parameter.
CVE-2022-27246 1 Misp 1 Misp 2024-11-21 6.1 Medium
An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.