Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-46020 1 Code-projects 1 Blood Bank 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 'remail', 'rphone' and 'rcity' parameters.
CVE-2023-46019 1 Code-projects 1 Blood Bank 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' parameter.
CVE-2023-46016 1 Code-projects 1 Blood Bank 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in the application URL.
CVE-2023-46015 1 Code-projects 1 Blood Bank 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' parameter in application URL.
CVE-2023-46003 1 I-doit 1 I-doit 2024-11-21 5.4 Medium
I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.
CVE-2023-45998 1 Kodcloud 1 Kodbox 2024-11-21 5.4 Medium
kodbox 1.44 is vulnerable to Cross Site Scripting (XSS). Customizing global HTML results in storing XSS.
CVE-2023-45992 1 Commscope 1 Ruckus Cloudpath Enrollment System 2024-11-21 9.6 Critical
A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to could allow a remote, unauthenticated attacker to execute persistent XSS and CSRF attacks against a user of the admin management interface. A successful attack, combined with a certain admin activity, could allow the attacker to gain full admin privileges on the exploited system.
CVE-2023-45985 1 Totolink 4 A7000r, A7000r Firmware, X5000r and 1 more 2024-11-21 7.5 High
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 were discovered to contain a stack overflow in the function setParentalRules. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2023-45984 1 Totolink 4 A7000r, A7000r Firmware, X5000r and 1 more 2024-11-21 8.8 High
TOTOLINK X5000R V9.1.0u.6118_B20201102 and TOTOLINK A7000R V9.1.0u.6115_B20201022 was discovered to contain a stack overflow via the lang parameter in the function setLanguageCfg.
CVE-2023-45958 1 Thirtybees 1 Thirty Bees 2024-11-21 6.1 Medium
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.
CVE-2023-45957 1 Thirtybees 1 Thirty Bees 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.
CVE-2023-45885 1 Nasa 1 Openmct 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.
CVE-2023-45881 1 Gibbonedu 1 Gibbon 2024-11-21 6.1 Medium
GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter must be set to Y to return HTML code. The filename attribute of the bodyfile1 parameter is reflected in the response.
CVE-2023-45879 1 Gibbonedu 1 Gibbon 2024-11-21 5.4 Medium
GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component.
CVE-2023-45869 1 Ilias 1 Ilias 2024-11-21 9 Critical
ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec() function in the execQuoted() method of the ilUtil class (/Services/Utilities/classes/class.ilUtil.php) This allows attackers to inject malicious commands into the system, potentially compromising the integrity, confidentiality, and availability of the ILIAS installation and the underlying operating system.
CVE-2023-45863 2 Linux, Redhat 2 Linux Kernel, Enterprise Linux 2024-11-21 6.4 Medium
An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.
CVE-2023-45862 3 Linux, Netapp, Redhat 6 Linux Kernel, Active Iq Unified Manager, H410c and 3 more 2024-11-21 5.5 Medium
An issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. An object could potentially extend beyond the end of an allocation.
CVE-2023-45852 1 Viessmann 2 Vitogate 300, Vitogate 300 Firmware 2024-11-21 9.8 Critical
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.
CVE-2023-45835 1 Libsyn 1 Libsyn Publisher Hub 2024-11-21 7.1 High
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Libsyn Libsyn Publisher Hub plugin <= 1.4.4 versions.
CVE-2023-45829 1 Happybox 1 Newsletter \& Bulk Email Sender 2024-11-21 6.5 Medium
Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress plugin <= 2.0.1 versions.