Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-18145 1 Baidu 1 Umeditor 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in umeditor v1.2.3 via /public/common/umeditor/php/getcontent.php.
CVE-2020-18126 1 Indexhibit 1 Indexhibit 2024-11-21 5.4 Medium
Multiple stored cross-site scripting (XSS) vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-18125 1 Indexhibit 1 Indexhibit 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the /plugin/ajax.php component of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML.
CVE-2020-18121 1 Indexhibit 1 Indexhibit 2024-11-21 8.8 High
A configuration issue in Indexhibit 2.1.5 allows authenticated attackers to modify .php files, leading to getshell.
CVE-2020-18102 1 Hotels Server Project 1 Hotels Server 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Hotels_Server v1.0 allows remote attackers to execute arbitrary code by injecting crafted commands the data fields in the component "/controller/publishHotel.php".
CVE-2020-18084 1 Yzmcms 1 Yzmcms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in yzmCMS v5.2 allows remote attackers to execute arbitrary code by injecting commands into the "referer" field of a POST request to the component "/member/index/login.html" when logging in.
CVE-2020-18066 1 Zrlog 1 Zrlog 2024-11-21 6.1 Medium
Cross Site Scripting vulnerability in ZrLog 2.1.0 via the (1) userName and (2) email parameters in post/addComment.
CVE-2020-18065 1 Popojicms 1 Popojicms 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.
CVE-2020-18048 1 Bertanddip 1 Craigms 2024-11-21 9.8 Critical
An issue in craigms/main.php of CraigMS 1.0 allows attackers to execute arbitrary commands via a crafted input entered into the DB Name field.
CVE-2020-18035 1 Jeesns 1 Jeesns 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Jeesns v1.4.2 allows remote attackers to execute arbitrary code by injecting commands into the "CKEditorFuncNum" parameter in the component "CkeditorUploadController.java".
CVE-2020-18022 1 Qibosoft 1 Qibocms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Qibosoft QiboCMS v7 and earlier allows remote attackers to execute arbitrary code or obtain sensitive information by injecting arbitrary commands in a HTTP request to the "ewebeditor\3.1.1\kindeditor.js" component.
CVE-2020-17999 1 1234n 1 Minicms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php".
CVE-2020-17891 1 Tp-link 2 Archer C1200, Archer C1200 Firmware 2024-11-21 6.1 Medium
TP-Link Archer C1200 firmware version 1.13 Build 2018/01/24 rel.52299 EU has a XSS vulnerability allowing a remote attacker to execute arbitrary code.
CVE-2020-17759 2 Evernote, Microsoft 4 Evernote, Windows 10, Windows 7 and 1 more 2024-11-21 8.8 High
An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941.
CVE-2020-17551 1 Impresscms 1 Impresscms 2024-11-21 4.8 Medium
ImpressCMS 1.4.0 is affected by XSS in modules/system/admin.php which may result in arbitrary remote code execution.
CVE-2020-17542 1 Dotcms 1 Dotcms 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) in dotCMS v5.1.5 allows remote attackers to execute arbitrary code by injecting a malicious payload into the "Task Detail" comment window of the "/dotAdmin/#/c/workflow" component.
CVE-2020-17541 2 Libjpeg-turbo, Redhat 2 Libjpeg-turbo, Enterprise Linux 2024-11-21 8.8 High
Libjpeg-turbo all version have a stack-based buffer overflow in the "transform" component. A remote attacker can send a malformed jpeg file to the service and cause arbitrary code execution or denial of service of the target service.
CVE-2020-17522 1 Apache 1 Traffic Control 2024-11-21 5.8 Medium
When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
CVE-2020-17505 1 Articatech 1 Web Proxy 2024-11-21 8.8 High
Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. These commands are executed with root privileges via service_cmds_peform.
CVE-2020-17504 1 Barco 5 Transform N, Transform Ndn-210 Lite, Transform Ndn-210 Pro and 2 more 2024-11-21 7.2 High
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.