Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43757 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-31792 1 Salesagility 1 Suitecrm 2024-11-21 5.4 Medium
XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field
CVE-2021-31778 1 Media2click Project 1 Media2click 2024-11-21 5.4 Medium
The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
CVE-2021-31761 1 Webmin 1 Webmin 2024-11-21 9.6 Critical
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.
CVE-2021-31738 1 Adiscon 1 Loganalyzer 2024-11-21 6.1 Medium
Adiscon LogAnalyzer 4.1.10 and 4.1.11 allow login.php XSS.
CVE-2021-31721 1 Chevereto 1 Chevereto 2024-11-21 6.1 Medium
Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.
CVE-2021-31712 1 React Draft Wysiwyg Project 1 React Draft Wysiwyg 2024-11-21 5.4 Medium
react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
CVE-2021-31682 1 Automatedlogic 1 Webctrl 2024-11-21 6.1 Medium
The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.
CVE-2021-31676 1 Pescms 1 Pescms Team 2024-11-21 6.1 Medium
A reflected XSS was discovered in PESCMS-V2.3.3. When combined with CSRF in the same file, they can cause bigger destruction.
CVE-2021-31674 1 Cyclos 1 Cyclos 2024-11-21 6.1 Medium
Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant.
CVE-2021-31673 1 Cyclos 1 Cyclos 2024-11-21 6.1 Medium
A Dom-based Cross-site scripting (XSS) vulnerability at registration account in Cyclos 4 PRO.14.7 and before allows remote attackers to inject arbitrary web script or HTML via the groupId parameter.
CVE-2021-31655 1 Trendnet 2 Tv-ip110wn, Tv-ip110wn Firmware 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in TRENDnet TV-IP110WN V1.2.2.64 V1.2.2.65 V1.2.2.68 via the profile parameter. in a GET request in view.cgi.
CVE-2021-31651 1 Neofr 1 Neofrag 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the copyright field in copyright settings.
CVE-2021-31643 1 Chiyu-tech 22 Bf-630, Bf-630 Firmware, Bf-631 and 19 more 2024-11-21 5.4 Medium
An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.
CVE-2021-31641 1 Chiyu-tech 30 Bf-430, Bf-430 Firmware, Bf-431 and 27 more 2024-11-21 6.1 Medium
An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology, including BF-630, BF-450M, BF-430, BF-431, BF631-W, BF830-W, Webpass, BF-MINI-W, and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.
CVE-2021-31589 1 Beyondtrust 1 Appliance Base Software 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper sanitization.
CVE-2021-31583 1 Sipwise 1 Next Generation Communication Platform 2024-11-21 5.4 Medium
Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname, lastname, company); and Reflected XSS in statistics/versions (GET lang).
CVE-2021-31579 1 Akkadianlabs 2 Ova Appliance, Provisioning Manager 2024-11-21 8.2 High
Akkadian Provisioning Manager Engine (PME) ships with a hard-coded credential, akkadianuser:haakkadianpassword. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
CVE-2021-31558 1 Deltaww 1 Diaenergie 2024-11-21 6.5 Medium
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAE_hierarchyHandler.ashx”.
CVE-2021-31551 1 Mediawiki 1 Mediawiki 2024-11-21 6.1 Medium
An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.
CVE-2021-31550 1 Mediawiki 1 Mediawiki 2024-11-21 5.4 Medium
An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS payloads into various layers.