Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (43682 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2021-26628 2 Linux, Maxb 2 Linux Kernel, Maxboard 2024-11-21 8.1 High
Insufficient script validation of the admin page enables XSS, which causes unauthorized users to steal admin privileges. When uploading file in a specific menu, the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files.
CVE-2021-26611 1 Hej 2 Hejhome Gkw-ic052, Hejhome Gkw-ic052 Firmware 2024-11-21 8.1 High
HejHome GKW-IC052 IP Camera contained a hard-coded credentials vulnerability. This issue allows remote attackers to operate the IP Camera.(reboot, factory reset, snapshot etc..)
CVE-2021-26596 1 Nokia 1 Netact 2024-11-21 5.4 Medium
An issue was discovered in Nokia NetAct 18A. A malicious user can change a filename of an uploaded file to include JavaScript code, which is then stored and executed by a victim's web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. Here, the /netact/sct filename parameter is used.
CVE-2021-26587 1 Hpe 12 Storeonce 3620, Storeonce 3620 Firmware, Storeonce 3640 and 9 more 2024-11-21 6.5 Medium
A potential DOM-based Cross Site Scripting security vulnerability has been identified in HPE StoreOnce. The vulnerability could be remotely exploited to cause an elevation of privilege leading to partial impact to confidentiality, availability, and integrity. HPE has made the following software update - HPE StoreOnce 4.3.0, to resolve the vulnerability in HPE StoreOnce.
CVE-2021-26584 1 Hp 1 Oneview For Vmware Vcenter 2024-11-21 6.1 Medium
A security vulnerability in HPE OneView for VMware vCenter (OV4VC) could be exploited remotely to allow Cross-Site Scripting. HPE has released the following software update to resolve the vulnerability in HPE OneView for VMware vCenter (OV4VC).
CVE-2021-26582 3 Hp, Microsoft, Redhat 4 Hp-ux, Icewall Sso Dgfw, Windows and 1 more 2024-11-21 6.1 Medium
A security vulnerability in HPE IceWall SSO Domain Gateway Option (Dgfw) module version 10.0 on RHEL 5/6/7, version 10.0 on HP-UX 11i v3, version 10.0 on Windows and 11.0 on Windows could be exploited remotely to allow cross-site scripting (XSS).
CVE-2021-26580 1 Hpe 1 Integrated Lights-out Amplifier 2024-11-21 6.1 Medium
A potential security vulnerability has been identified in HPE iLO Amplifier Pack. The vulnerability could be remotely exploited to allow Cross-Site Scripting (XSS). HPE has provided the following software update to resolve the vulnerability in HPE iLO Amplifier Pack: HPE iLO Amplifier Pack 1.95 or later.
CVE-2021-26579 1 Hpe 1 Unified Data Management 2024-11-21 5.5 Medium
A security vulnerability in HPE Unified Data Management (UDM) could allow the local disclosure of privileged information (CWE-321: Use of Hard-coded Cryptographic Key in a product). HPE has provided updates to versions 1.2009.0 and 1.2101.0 of HPE Unified Data Management (UDM). Version 1.2103.0 of HPE Unified Data Management (UDM) removes all hard-coded cryptographic keys.
CVE-2021-26549 1 Smartfoxserver 1 Smartfoxserver 2024-11-21 5.4 Medium
An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.
CVE-2021-26475 1 Eprints 1 Eprints 2024-11-21 6.1 Medium
EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.
CVE-2021-26304 1 Phpgurukul 1 Daily Expense Tracker System 2024-11-21 5.4 Medium
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.
CVE-2021-26303 1 Phpgurukul 1 Daily Expense Tracker System 2024-11-21 6.1 Medium
PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.
CVE-2021-26263 1 Odoo 1 Odoo 2024-11-21 6.1 Medium
Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to inject arbitrary web script in the browser of a victim, by posting crafted contents.
CVE-2021-26247 1 Cacti 1 Cacti 2024-11-21 6.1 Medium
As an unauthenticated remote user, visit "http://<CACTI_SERVER>/auth_changepassword.php?ref=<script>alert(1)</script>" to successfully execute the JavaScript payload present in the "ref" URL parameter.
CVE-2021-26230 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the user information to save_user.php.
CVE-2021-26227 1 Casap Automated Enrollment System Project 1 Casap Automated Enrollment System 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the student information parameters to edit_stud.php.
CVE-2021-26224 1 Fantastic Blog Project 1 Fantastic Blog 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in SourceCodester Fantastic-Blog-CMS V 1.0 allows remote attackers to inject arbitrary web script or HTML via the search field to search.php.
CVE-2021-26123 1 Livinglogic 1 Xist4c 2024-11-21 6.1 Medium
LivingLogic XIST4C before 0.107.8 allows XSS via login.htm, login.wihtm, or login-form.htm.
CVE-2021-26122 1 Livinglogic 1 Xist4c 2024-11-21 6.1 Medium
LivingLogic XIST4C before 0.107.8 allows XSS via feedback.htm or feedback.wihtm.
CVE-2021-26108 1 Fortinet 1 Fortios 2024-11-21 7.5 High
A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve the key by reverse engineering.