Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43782 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-43186 1 Jetbrains 1 Youtrack 2024-11-21 5.4 Medium
JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.
CVE-2021-43184 1 Jetbrains 1 Youtrack 2024-11-21 5.4 Medium
In JetBrains YouTrack before 2021.3.21051, stored XSS is possible.
CVE-2021-43181 1 Jetbrains 1 Hub 2024-11-21 6.1 Medium
In JetBrains Hub before 2021.1.13690, stored XSS is possible.
CVE-2021-43154 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in CMS Made Simple 2.2.15 via the Name field in an Add Category action in moduleinterface.php.
CVE-2021-43137 1 Phpgurukul 1 Hostel Management System 2024-11-21 8.8 High
Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) vulnerability exits in hostel management system 2.1 via the name field in my-profile.php. Chaining to this both vulnerabilities leads to account takeover.
CVE-2021-43136 1 Formalms 1 Formalms 2024-11-21 9.8 Critical
An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platform.
CVE-2021-43081 1 Fortinet 2 Fortios, Fortiproxy 2024-11-21 6.1 Medium
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.0.3 and below, 6.4.8 and below, 6.2.10 and below, 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below, 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.
CVE-2021-43080 1 Fortinet 1 Fortios 2024-11-21 4.6 Medium
An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiOS version 7.2.0, version 6.4.0 through 6.4.9, version 7.0.0 through 7.0.5 may allow an authenticated attacker to perform a stored cross site scripting (XSS) attack through the URI parameter via the Threat Feed IP address section of the Security Fabric External connectors.
CVE-2021-43063 1 Fortinet 1 Fortiweb 2024-11-21 6.1 Medium
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiWeb version 6.4.1 and 6.4.0, version 6.3.15 and below, version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the login webpage.
CVE-2021-43062 1 Fortinet 1 Fortimail 2024-11-21 6.1 Medium
A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code or commands via crafted HTTP GET requests to the FortiGuard URI protection service.
CVE-2021-43052 1 Tibco 1 Ftl 2024-11-21 9.3 Critical
The Realm Server component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows authentication bypass due to a hard coded secret used in the default realm server of the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.7.2 and below, TIBCO FTL - Developer Edition: versions 6.7.2 and below, and TIBCO FTL - Enterprise Edition: versions 6.7.2 and below.
CVE-2021-43047 1 Tibco 1 Partnerexpress 2024-11-21 9 Critical
The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.
CVE-2021-43044 1 Kaseya 1 Unitrends Backup 2024-11-21 9.8 Critical
An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community.
CVE-2021-43032 1 Xenforo 1 Xenforo 2024-11-21 4.8 Medium
In XenForo through 2.2.7, a threat actor with access to the admin panel can create a new Advertisement via the Advertising function, and save an XSS payload in the body of the HTML document. This payload will execute globally on the client side.
CVE-2021-43009 1 Opservices 1 Opmon 2024-11-21 6.1 Medium
A Cross Site Scripting (XSS) vulnerability exists in OpServices OpMon through 9.11 via the search parameter in the request URL.
CVE-2021-42970 1 Cxuu 1 Cxuucms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in cxuucms v3 via the imgurl of /feedback/post/ content parameter.
CVE-2021-42946 1 Htmly 1 Htmly 2024-11-21 4.8 Medium
A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.
CVE-2021-42943 1 Ipplan Project 1 Ipplan 2024-11-21 5.4 Medium
Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter.
CVE-2021-42940 1 Projeqtor 1 Projeqtor 2024-11-21 9.9 Critical
A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code.
CVE-2021-42892 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 4.3 Medium
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.