Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9426 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-32991 1 Jenkins 1 Saml Single Sign On 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.
CVE-2023-32989 1 Jenkins 1 Azure Vm Agents 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier allows attackers to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.
CVE-2023-32995 1 Jenkins 1 Saml Single Sign On 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier allows attackers to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange's API for sending emails.
CVE-2023-50886 1 Wpwax 1 Legal Pages 2025-01-23 4.3 Medium
Cross-Site Request Forgery (CSRF), Incorrect Authorization vulnerability in wpWax Legal Pages.This issue affects Legal Pages: from n/a through 1.3.7.
CVE-2023-50861 1 Pluginus 1 Husky - Products Filter Professional For Woocommerce 2025-01-23 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in realmag777 HUSKY – Products Filter for WooCommerce (formerly WOOF).This issue affects HUSKY – Products Filter for WooCommerce (formerly WOOF): from n/a through 1.3.4.3.
CVE-2024-13215 1 Webtechstreet 1 Elementor Addon Elements 2025-01-23 4.3 Medium
The Elementor Addon Elements plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.13.10 via the 'render' function in modules/modal-popup/widgets/modal-popup.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, scheduled, and draft template data.
CVE-2025-23806 2025-01-23 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe allows Reflected XSS. This issue affects Ultimate Subscribe: from n/a through 1.3.
CVE-2023-33006 1 Jenkins 1 Wso2 Oauth 2025-01-23 5.4 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins WSO2 Oauth Plugin 1.0 and earlier allows attackers to trick users into logging in to the attacker's account.
CVE-2023-33003 1 Jenkins 1 Tag Profiler 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Tag Profiler Plugin 0.2 and earlier allows attackers to reset profiler statistics.
CVE-2023-32998 1 Jenkins 1 Appspider 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins AppSpider Plugin 1.0.15 and earlier allows attackers to connect to an attacker-specified URL and send an HTTP POST request with a JSON payload consisting of attacker-specified credentials.
CVE-2023-32987 1 Jenkins 1 Reverse Proxy Auth 2025-01-23 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Reverse Proxy Auth Plugin 1.7.4 and earlier allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2023-32980 2 Jenkins, Redhat 2 Email Extension, Openshift 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Email Extension Plugin allows attackers to make another user stop watching an attacker-specified job.
CVE-2023-32978 1 Jenkins 1 Lightweight Directory Access Protocol 2025-01-23 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins LDAP Plugin allows attackers to connect to an attacker-specified LDAP server using attacker-specified credentials.
CVE-2024-31985 1 Xwiki 1 Xwiki 2025-01-23 5.4 Medium
XWiki Platform is a generic wiki platform. Starting in version 3.1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, it is possible to schedule/trigger/unschedule existing jobs by having an admin visit the Job Scheduler page through a predictable URL, for example by embedding such an URL in any content as an image. The vulnerability has been fixed in XWiki 14.10.19, 15.5.5, and 15.9. As a workaround, manually apply the patch by modifying the `Scheduler.WebHome` page.
CVE-2024-31363 1 Lifterlms 1 Lifterlms 2025-01-23 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in LifterLMS.This issue affects LifterLMS: from n/a through 7.5.0.
CVE-2024-43301 1 Fontsplugin 1 Fonts 2025-01-23 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Fonts Plugin Fonts allows Stored XSS.This issue affects Fonts: from n/a through 3.7.7.
CVE-2023-2195 1 Jenkins 1 Code Dx 2025-01-22 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2023-2631 1 Jenkins 1 Code Dx 2025-01-22 4.3 Medium
A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL.
CVE-2024-32785 1 Webangon 1 The Pack Elementor Addons 2025-01-22 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Webangon The Pack Elementor addons allows Cross-Site Scripting (XSS).This issue affects The Pack Elementor addons: from n/a through 2.0.8.3.
CVE-2024-32793 1 Strangerstudios 1 Paid Memberships Pro 2025-01-22 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Paid Memberships Pro.This issue affects Paid Memberships Pro: from n/a through 2.12.10.