Export limit exceeded: 380706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (41104 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-25508 | 2 Guangzhou Luhua Information Technology, Ruvar | 2 Ruvaroa, Ruvaroa | 2025-04-16 | 9.8 Critical |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /bulletin/bulletin_template_show.aspx. | ||||
| CVE-2024-25512 | 1 Ruvar | 1 Ruvaroa | 2025-04-16 | 8.1 High |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the attach_id parameter at /Bulletin/AttachDownLoad.aspx. | ||||
| CVE-2024-25509 | 1 Ruvar | 1 Ruvaroa | 2025-04-16 | 9.4 Critical |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_file_download.aspx. | ||||
| CVE-2024-25510 | 2 Guangzhou Luhua Information Technology, Ruvar | 2 Ruvaroa, Ruvaroa | 2025-04-16 | 9.8 Critical |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_show.aspx. | ||||
| CVE-2024-25511 | 1 Ruvar | 2 Ruvaroa, Ruvaroa | 2025-04-16 | 9.4 Critical |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /AddressBook/address_public_new.aspx. | ||||
| CVE-2024-25513 | 1 Ruvar | 1 Ruvaroa | 2025-04-16 | 7.8 High |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /CorporateCulture/kaizen_download.aspx. | ||||
| CVE-2024-25514 | 1 Ruvar | 1 Ruvaroa | 2025-04-16 | 9.4 Critical |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /SysManage/wf_template_child_field_list.aspx. | ||||
| CVE-2024-25515 | 1 Ruvar | 1 Ruvaroa | 2025-04-16 | 7.3 High |
| RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter at /WorkFlow/wf_work_finish_file_down.aspx. | ||||
| CVE-2025-23053 | 1 Arubanetworks | 1 Fabric Composer | 2025-04-16 | 6.5 Medium |
| A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system. | ||||
| CVE-2025-23054 | 1 Arubanetworks | 1 Fabric Composer | 2025-04-16 | 6.5 Medium |
| A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations. | ||||
| CVE-2024-33444 | 1 Onethink | 1 Onethink | 2025-04-16 | 9.8 Critical |
| SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component. | ||||
| CVE-2023-49982 | 2 Oretnom23, Sourcecodester | 2 School Fees Management System, School Fees Management System | 2025-04-16 | 8.8 High |
| Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges and perform Administrative actions, including adding and deleting user accounts. | ||||
| CVE-2024-2587 | 1 Amss\+\+ Project | 1 Amss\+\+ | 2025-04-16 | 8.2 High |
| Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_khet_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. | ||||
| CVE-2024-2588 | 1 Amss\+\+ Project | 1 Amss\+\+ | 2025-04-16 | 8.2 High |
| Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/admin/index.php, in the 'id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB. | ||||
| CVE-2021-43938 | 1 Smartptt | 1 Scada Server | 2025-04-16 | 8.1 High |
| Elcomplus SmartPTT SCADA Server is vulnerable to an unauthenticated user can request various files from the server without any authentication or authorization. | ||||
| CVE-2022-1358 | 1 Cambiumnetworks | 1 Cnmaestro | 2025-04-16 | 5.9 Medium |
| The affected On-Premise is vulnerable to data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate and dump all data held in the cnMaestro database. | ||||
| CVE-2022-1361 | 1 Cambiumnetworks | 1 Cnmaestro | 2025-04-16 | 7.4 High |
| The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate data about other user’s accounts and devices. | ||||
| CVE-2021-32965 | 1 Deltaww | 1 Diascreen | 2025-04-16 | 7.8 High |
| Delta Electronics DIAScreen versions prior to 1.1.0 are vulnerable to type confusion, which may allow an attacker to remotely execute arbitrary code. | ||||
| CVE-2022-28690 | 1 Hornerautomation | 1 Cscape | 2025-04-16 | 7.8 High |
| The affected product is vulnerable to an out-of-bounds write via uninitialized pointer, which may allow an attacker to execute arbitrary code. | ||||
| CVE-2022-29488 | 1 Hornerautomation | 1 Cscape | 2025-04-16 | 7.8 High |
| The affected product is vulnerable to an out-of-bounds read via uninitialized pointer, which may allow an attacker to execute arbitrary code. | ||||