Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44035 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-38653 1 Hcltech 1 Digital Experience 2025-04-18 2 Low
In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
CVE-2024-51055 1 Hoosk 1 Hoosk 2025-04-18 6.5 Medium
An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component.
CVE-2023-46950 1 Contribsys 1 Sidekiq 2025-04-18 6.1 Medium
Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions.
CVE-2022-37832 1 Mutiny 1 Mutiny 2025-04-18 9.8 Critical
Mutiny 7.2.0-10788 suffers from Hardcoded root password.
CVE-2022-36223 1 Emby 1 Emby 2025-04-18 6.1 Medium
In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account.
CVE-2024-24511 1 Pkp.sfu 1 Open Journal Systems 2025-04-18 6.1 Medium
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.
CVE-2024-24512 2 Pkp, Pkp.sfu 2 Open Journal Systems, Open Journal Systems 2025-04-18 6.1 Medium
Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.
CVE-2024-30618 1 Chamilo 1 Chamilo Lms 2025-04-18 6.1 Medium
A Stored Cross-Site Scripting (XSS) Vulnerability in Chamilo LMS 1.11.26 allows a remote attacker to execute arbitrary JavaScript in a web browser by including a malicious payload in the 'content' parameter of 'group_topics.php'.
CVE-2024-27525 1 Chamilo 1 Chamilo Lms 2025-04-18 4.6 Medium
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows a remote attacker to escalate privileges via a crafted script to the filename parameter of the home.php component.
CVE-2024-3755 1 Mf Gig Calendar Project 1 Mf Gig Calendar 2025-04-18 5.4 Medium
The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2024-33859 1 Logpoint 1 Siem 2025-04-18 6.1 Medium
An issue was discovered in Logpoint before 7.4.0. HTML code sent through logs wasn't being escaped in the "Interesting Field" Web UI, leading to XSS.
CVE-2024-51142 1 Chamilo 1 Chamilo Lms 2025-04-18 6.1 Medium
Cross Site Scripting vulnerability in Chamilo LMS v.1.11.26 allows an attacker to execute arbitrary code via the svkey parameter of the storageapi.php file.
CVE-2024-13347 1 Smartdatasoft 1 Essential Wp Real Estate 2025-04-18 6.8 Medium
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting.
CVE-2025-22664 1 Ays-pro 1 Survey Maker 2025-04-18 5.9 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS. This issue affects Survey Maker: from n/a through 5.1.3.5.
CVE-2025-24028 1 Joplin Project 1 Joplin 2025-04-18 7.8 High
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is caused by differences between how Joplin's HTML sanitizer handles comments and how the browser handles comments. This affects both the Rich Text Editor and the Markdown viewer. However, unlike the Rich Text Editor, the Markdown viewer is `cross-origin isolated`, which prevents JavaScript from directly accessing functions/variables in the toplevel Joplin `window`. This issue is not present in Joplin 3.1.24 and may have been introduced in `9b50539`. This is an XSS vulnerability that impacts users that open untrusted notes in the Rich Text Editor. This vulnerability has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2025-25988 1 Hoosk 1 Hoosk 2025-04-18 4.8 Medium
Cross Site Scripting vulnerability in hooskcms v.1.8 allows a remote attacker to cause a denial of service via the custom Link title parameter and the Title parameter.
CVE-2025-25990 1 Hoosk 1 Hoosk 2025-04-18 6.1 Medium
Cross Site Scripting vulnerability in hooskcms v.1.7.1 allows a remote attacker to obtain sensitive information via the /install/index.php component.
CVE-2024-50426 1 Ays-pro 1 Survey Maker 2025-04-18 5.9 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Survey Maker team Survey Maker allows Stored XSS.This issue affects Survey Maker: from n/a through 5.0.2.
CVE-2024-2593 1 Amss\+\+ Project 1 Amss\+\+ 2025-04-17 7.1 High
Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVE-2023-5980 1 Bannersky 1 Bsk Forms Blacklist 2025-04-17 4.8 Medium
The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).