Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (41104 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-27906 1 Apache 1 Airflow 2025-05-06 5.9 Medium
Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. Users of Apache Airflow are recommended to upgrade to version 2.8.2 or newer to mitigate the risk associated with this vulnerability
CVE-2024-42765 2 Kashipara, Kjayvik 2 Bus Ticket Reservation System, Bus Ticket Reservation System 2025-05-06 9.8 Critical
A SQL injection vulnerability in "/login.php" of the Kashipara Bus Ticket Reservation System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the "email" or "password" Login page parameters.
CVE-2022-3322 1 Cloudflare 1 Warp Mobile Client 2025-05-05 6.7 Medium
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.
CVE-2022-3616 1 Cloudflare 1 Octorpki 2025-05-05 5.4 Medium
Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter. In consequence it would cause the program to crash, preventing it from finishing the validation and leading to a denial of service. Credits to Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE, who discovered and reported this vulnerability.
CVE-2022-43352 1 Sanitization Management System Project 1 Sanitization Management System 2025-05-05 7.2 High
Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_quote.
CVE-2022-42788 1 Apple 1 Macos 2025-05-05 5.5 Medium
A permissions issue existed. This issue was addressed with improved permission validation. This issue is fixed in macOS Ventura 13. A malicious application may be able to read sensitive location information.
CVE-2022-3059 1 Schoolbox 1 Schoolbox 2025-05-05 8.6 High
The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.
CVE-2022-43350 1 Sanitization Management System Project 1 Sanitization Management System 2025-05-05 7.2 High
Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquiry.
CVE-2022-43052 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.
CVE-2022-43051 1 Online Diagnostic Lab Management System Project 1 Online Diagnostic Lab Management System 2025-05-05 7.2 High
Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_test.
CVE-2022-43049 1 Canteen Management System Project 1 Canteen Management System 2025-05-05 7.2 High
Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.
CVE-2022-42990 1 Oretnom23 1 Food Ordering Management System 2025-05-05 7.2 High
Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
CVE-2018-11528 1 Wuzhicms 1 Wuzhicms 2025-05-05 N/A
WUZHI CMS 4.1.0 has SQL Injection via an api/sms_check.php?param= URI.
CVE-2022-27431 1 Wuzhicms 1 Wuzhicms 2025-05-05 9.8 Critical
Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
CVE-2020-20122 1 Wuzhicms 1 Wuzhicms 2025-05-05 9.8 Critical
Wuzhi CMS v4.1 contains a SQL injection vulnerability in the checktitle() function in /coreframe/app/content/admin/content.php.
CVE-2024-25288 2 Slims, Slims Project 2 Senayan Library Management System, Slims 2025-05-05 4.9 Medium
SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.
CVE-2022-32208 7 Apple, Debian, Fedoraproject and 4 more 21 Macos, Debian Linux, Fedora and 18 more 2025-05-05 5.9 Medium
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.
CVE-2022-25235 6 Debian, Fedoraproject, Libexpat Project and 3 more 12 Debian Linux, Fedora, Libexpat and 9 more 2025-05-05 9.8 Critical
xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is valid in a certain context.
CVE-2022-23596 2 Junrar Project, Redhat 2 Junrar, Jboss Fuse 2025-05-05 7.5 High
Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.
CVE-2022-23221 4 Debian, H2database, Oracle and 1 more 6 Debian Linux, H2, Communications Cloud Native Core Console and 3 more 2025-05-05 9.8 Critical
H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.