Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-42940 1 Projeqtor 1 Projeqtor 2024-11-21 9.9 Critical
A Cross Site Scripting (XSS) vulnerability exists in Projeqtor 9.3.1 via /projeqtor/tool/saveAttachment.php, which allows an attacker to upload a SVG file containing malicious JavaScript code.
CVE-2021-42897 1 Feminer Wms Project 1 Feminer Wms 2024-11-21 9.8 Critical
A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed into the $mysqlstr and is executed by exec.
CVE-2021-42892 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 4.3 Medium
In TOTOLINK EX1200T V4.1.2cu.5215, an attacker can start telnet without authorization because the default username and password exists in the firmware.
CVE-2021-42890 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function NTPSyncWithHost of the file system.so which can control hostTime to attack.
CVE-2021-42888 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setLanguageCfg of the file global.so which can control langType to attack.
CVE-2021-42885 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceMac of the file global.so which can control deviceName to attack.
CVE-2021-42884 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in function setDeviceName of the file global.so which can control thedeviceName to attack.
CVE-2021-42875 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5215 contains a remote command injection vulnerability in the function setDiagnosisCfg of the file lib/cste_modules/system.so to control the ipDoamin.
CVE-2021-42872 1 Totolink 2 Ex1200t, Ex1200t Firmware 2024-11-21 9.8 Critical
TOTOLINK EX1200T V4.1.2cu.5215 is affected by a command injection vulnerability that can remotely execute arbitrary code.
CVE-2021-42869 1 Chikitsa 1 Patient Management Software 2024-11-21 4.8 Medium
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patient_report, (3) /appointment_report, (4) visit_report, and (5) /bill_detail_report pages.
CVE-2021-42868 1 Chikitsa 1 Patient Management Software 2024-11-21 4.8 Medium
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. .
CVE-2021-42867 1 Htmly 1 Htmly 2024-11-21 4.8 Medium
A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.
CVE-2021-42866 1 Pixelimity 1 Pixelimity 2024-11-21 4.8 Medium
A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php
CVE-2021-42860 1 Mini-xml Project 1 Mini-xml 2024-11-21 7.5 High
A stack buffer overflow exists in Mini-XML v3.2. When inputting an unformed XML string to the mxmlLoadString API, it will cause a stack-buffer-overflow in mxml_string_getc:2611. NOTE: it is unclear whether this input is allowed by the API specification
CVE-2021-42859 1 Mini-xml Project 1 Mini-xml 2024-11-21 7.5 High
A memory leak issue was discovered in Mini-XML v3.2 that could cause a denial of service. NOTE: testing reports are inconsistent, with some testers seeing the issue in both the 3.2 release and in the October 2021 development code, but others not seeing the issue in the 3.2 release
CVE-2021-42856 1 Riverbed 1 Steelcentral Appinternals Dynamic Sampling Agent 2024-11-21 4.7 Medium
It was discovered that the /DsaDataTest endpoint is susceptible to Cross-site scripting (XSS) attack. It was noted that the Metric parameter does not have any input checks on the user input that allows an attacker to craft its own malicious payload to trigger a XSS vulnerability.
CVE-2021-42855 1 Riverbed 1 Steelcentral Appinternals Dynamic Sampling Agent 2024-11-21 7.8 High
It was discovered that the SteelCentral AppInternals Dynamic Sampling Agent (DSA) uses the ".debug_command.config" file to store a json string that contains a list of IDs and pre-configured commands. The config file is subsequently used by the "/api/appInternals/1.0/agent/configuration" API to map the corresponding ID to a command to be executed.
CVE-2021-42852 1 Lenovo 10 A1, A1 Firmware, T1 and 7 more 2024-11-21 8 High
A command injection vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow an authenticated user to execute operating system commands by sending a crafted packet to the device.
CVE-2021-42850 1 Lenovo 10 A1, A1 Firmware, T1 and 7 more 2024-11-21 8.8 High
A weak default administrator password for the web interface and serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical or local network access.
CVE-2021-42849 1 Lenovo 10 A1, A1 Firmware, T1 and 7 more 2024-11-21 6.8 Medium
A weak default password for the serial port was reported in some Lenovo Personal Cloud Storage devices that could allow unauthorized device access to an attacker with physical access.