Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43785 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-45018 1 Catfish-cms 1 Catfish Cms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in Catfish <=6.3.0 via a Google search in url:/catfishcms/index.php/admin/Index/addmenu.htmland then the .html file on the website that uses this editor (the file suffix is allowed).
CVE-2021-44970 1 1234n 1 Minicms 2024-11-21 5.4 Medium
MiniCMS v1.11 was discovered to contain a cross-site scripting (XSS) vulnerability via /mc-admin/page-edit.php.
CVE-2021-44969 1 Taogogo 1 Taocms 2024-11-21 4.8 Medium
Taocms v3.0.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Management Column component.
CVE-2021-44916 1 Opmantek 1 Open-audit 2024-11-21 6.1 Medium
Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL, malicious JavaScript code can be executed in the victim's browser.
CVE-2021-44912 1 Xpressengine 1 Xpressengine 2024-11-21 5.4 Medium
In XE 1.116, when uploading the Normal button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper, for example before the XE 1.11.2 version, you can upload the PHP type file to GETSHELL.
CVE-2021-44911 1 Xpressengine 1 Xpressengine 2024-11-21 5.4 Medium
XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button, there is no restriction on the file suffix, which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type, uploading HTML-type files leads to stored XSS vulnerabilities.
CVE-2021-44896 1 Dmproadmap Project 1 Dmproadmap 2024-11-21 6.1 Medium
DMP Roadmap before 3.0.4 allows XSS.
CVE-2021-44829 1 Afi-solutions 1 Webacms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in index.html in AFI WebACMS through 2.1.0 via the the ID parameter.
CVE-2021-44791 1 Apache 1 Druid 2024-11-21 6.1 Medium
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
CVE-2021-44775 1 Odoo 1 Odoo 2024-11-21 6.1 Medium
Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
CVE-2021-44749 1 F-secure 1 Safe 2024-11-21 5.5 Medium
A vulnerability affecting F-Secure SAFE browser protection was discovered improper URL handling can be triggered to cause universal cross-site scripting through browsing protection in a SAFE web browser. User interaction is required prior to exploitation. A successful exploitation may lead to arbitrary code execution.
CVE-2021-44748 1 F-secure 1 Safe 2024-11-21 5.5 Medium
A vulnerability affecting F-Secure SAFE browser was discovered whereby browsers loads images automatically this vulnerability can be exploited remotely by an attacker to execute the JavaScript can be used to trigger universal cross-site scripting through the browser. User interaction is required prior to exploitation, such as entering a malicious website to trigger the vulnerability.
CVE-2021-44726 1 Knime 1 Knime Server 2024-11-21 8.8 High
KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.
CVE-2021-44720 2 Ivanti, Pulsesecure 2 Connect Secure, Pulse Connect Secure 2024-11-21 7.2 High
In Ivanti Pulse Secure Pulse Connect Secure (PCS) before 9.1R12, the administrator password is stored in the HTML source code of the "Maintenance > Push Configuration > Targets > Target Name" targets.cgi screen. A read-only administrative user can escalate to a read-write administrative role.
CVE-2021-44667 1 Alibaba 1 Nacos 2024-11-21 6.1 Medium
A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
CVE-2021-44662 1 Nottingham.ac 1 Xerte Online Toolkits 2024-11-21 6.1 Medium
A Site Scripting (XSS) vulnerability exists in the Xerte Project Xerte through 3.8.4 via the link parameter in print.php.
CVE-2021-44649 1 Django-cms 1 Django Cms 2024-11-21 5.4 Medium
Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.
CVE-2021-44608 1 Bloofox 1 Bloofoxcms 2024-11-21 5.4 Medium
Multiple Cross Site Scripting (XSS) vulnerabilities exists in bloofoxCMS 0.5.2.1 - 0.5.1 via the (1) file parameter and (2) type parameter in an edit action in index.php.
CVE-2021-44607 1 Thedaylightstudio 1 Fuel Cms 2024-11-21 5.4 Medium
A Cross Site Scripting (XSS) vulnerability exists in FUEL-CMS 1.5.1 in the Assets page via an SVG file.
CVE-2021-44598 1 Attendance Management System Project 1 Attendance Management System 2024-11-21 6.1 Medium
Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system, by using the XSS-reflected method, and then can store information by injecting the admin account on this system.