Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (338285 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2020-28401 1 Iris 1 Star Practice Management 2025-05-30 6.5 Medium
An improper authorization vulnerability exists in Star Practice Management Web version 2019.2.0.6, allowing an unauthorized user to access WIP details about jobs he should not have access to.
CVE-2020-26546 1 Evolutionscript 1 Helpdeskz 2025-05-30 7.5 High
An issue was discovered in HelpDeskZ 1.0.2. The feature to auto-login a user, via the RememberMe functionality, is prone to SQL injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2020-26167 1 Thedaylightstudio 1 Fuel Cms 2025-05-30 9.8 Critical
In FUEL CMS 11.4.12 and before, the page preview feature allows an anonymous user to take complete ownership of any account including an administrator one.
CVE-2020-15595 1 Zohocorp 1 Manageengine Application Control Plus 2025-05-30 4.3 Medium
An issue was discovered in Zoho Application Control Plus before version 10.0.511. The Element Configuration feature (to configure elements included in the scope of elements managed by the product) allows an attacker to retrieve the entire list of the IP ranges and subnets configured in the product and consequently obtain information about the cartography of the internal networks to which the product has access.
CVE-2020-15594 1 Zohocorp 1 Manageengine Application Control Plus 2025-05-30 4.3 Medium
An SSRF issue was discovered in Zoho Application Control Plus before version 10.0.511. The mail gateway configuration feature allows an attacker to perform a scan in order to discover open ports on a machine as well as available machines on the network segment on which the instance of the product is deployed.
CVE-2019-7162 1 Zohocorp 1 Manageengine Adselfservice Plus 2025-05-30 9.1 Critical
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.6 Build 5607. An exposed service allows an unauthenticated person to retrieve internal information from the system and modify the product installation.
CVE-2019-7161 1 Zohocorp 1 Manageengine Adselfservice Plus 2025-05-30 N/A
An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data.
CVE-2019-6970 1 Moodle 1 Moodle 2025-05-30 N/A
Moodle 3.5.x before 3.5.4 allows SSRF.
CVE-2019-6516 1 Wso2 1 Dashboard Server 2025-05-30 N/A
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to force the application to perform requests to the internal workstation (port-scanning) and to perform requests to adjacent workstations (network-scanning), aka SSRF.
CVE-2019-6515 1 Wso2 1 Api Manager 2025-05-30 N/A
An issue was discovered in WSO2 API Manager 2.6.0. Uploaded documents for API documentation are available to an unauthenticated user.
CVE-2019-6514 1 Wso2 1 Dashboard Server 2025-05-30 N/A
An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS.
CVE-2019-6513 1 Wso2 1 Api Manager 2025-05-30 N/A
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-6512 1 Wso2 1 Api Manager 2025-05-30 N/A
An issue was discovered in WSO2 API Manager 2.6.0. It is possible to force the application to perform requests to the internal workstation (SSRF port-scanning), other adjacent workstations (SSRF network scanning), or to enumerate files because of the existence of the file:// wrapper.
CVE-2019-3905 1 Zohocorp 1 Manageengine Adselfservice Plus 2025-05-30 N/A
Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.
CVE-2018-18466 1 Securenvoy 1 Securaccess 2025-05-30 N/A
An issue was discovered in SecurEnvoy SecurAccess 9.3.502. When put in Debug mode and used for RDP connections, the application stores the emergency credentials in cleartext in the logs (present in the DEBUG folder) that can be accessed by anyone. NOTE: The vendor disputes this as a vulnerability since the disclosure of a local account password (actually an alpha numeric passcode) is achievable only when a custom registry key is added to the windows registry. This action requires administrator access and the registry key is only provided by support staff at securenvoy to troubleshoot customer issues.
CVE-2018-10213 1 Vaultize 1 Enterprise File Sharing 2025-05-30 N/A
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it.
CVE-2018-10212 1 Vaultize 1 Enterprise File Sharing 2025-05-30 N/A
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization leading to creation of folders within another account via a modified device value.
CVE-2018-10211 1 Vaultize 1 Enterprise File Sharing 2025-05-30 N/A
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is improper authorization when listing the history of another user via a modified "vaultize_session_id" value in a cookie.
CVE-2018-10210 1 Vaultize 1 Enterprise File Sharing 2025-05-30 N/A
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. Enumeration of users is possible through the password-reset feature.
CVE-2018-10209 1 Vaultize 1 Enterprise File Sharing 2025-05-30 N/A
An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name.