Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-30231 1 Chinamobile 2 An Lianbao Wf-1, An Lianbao Wf-1 Firmware 2024-11-21 9.8 Critical
The api/zrDm/set_ZRElink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the bssaddr, abiaddr, devtoken, devid, elinksync, or elink_proc_enable parameter.
CVE-2021-30230 1 Chinamobile 2 An Lianbao Wf-1, An Lianbao Wf-1 Firmware 2024-11-21 9.8 Critical
The api/ZRFirmware/set_time_zone interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the zonename parameter.
CVE-2021-30229 1 Chinamobile 2 An Lianbao Wf-1, An Lianbao Wf-1 Firmware 2024-11-21 8.8 High
The api/zrDm/set_zrDm interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the dm_enable, AppKey, or Pwd parameter.
CVE-2021-30228 1 Chinamobile 2 An Lianbao Wf-1, An Lianbao Wf-1 Firmware 2024-11-21 9.8 Critical
The api/ZRAndlink/set_ZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iandlink_proc_enable parameter.
CVE-2021-30227 1 Emlog 1 Emlog 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in the article comments feature in emlog 6.0.
CVE-2021-30214 1 Eng 1 Knowage 2024-11-21 5.4 Medium
Knowage Suite 7.3 is vulnerable to Stored Client-Side Template Injection in '/knowage/restful-services/signup/update' via the 'name' parameter.
CVE-2021-30213 1 Eng 1 Knowage 2024-11-21 6.1 Medium
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.
CVE-2021-30212 1 Eng 1 Knowage 2024-11-21 5.4 Medium
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter.
CVE-2021-30211 1 Eng 1 Knowage 2024-11-21 5.4 Medium
Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter.
CVE-2021-30174 1 Ruiyanai 1 Cloudiso 2024-11-21 5.4 Medium
RiyaLab CloudISO event item is added, special characters in specific field of time management page are not properly filtered, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks.
CVE-2021-30172 1 Junhetec 1 Omnidirectional Communication System 2024-11-21 4.6 Medium
Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS (Cross-site scripting) attacks, additionally access and manipulate customer’s information.
CVE-2021-30171 1 Junhetec 1 Enterprise Resource Planning Point Of Sale System 2024-11-21 4.6 Medium
Special characters of ERP POS news page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
CVE-2021-30170 1 Junhetec 1 Enterprise Resource Planning Point Of Sale System 2024-11-21 4.6 Medium
Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS (Stored Cross-site scripting) attacks, additionally access and manipulate customer’s information.
CVE-2021-30166 1 Meritlilin 82 P2g1022, P2g1022 Firmware, P2g1022x and 79 more 2024-11-21 7.2 High
The NTP Server configuration function of the IP camera device is not verified with special parameters. Remote attackers can perform a command Injection attack and execute arbitrary commands after logging in with the privileged permission.
CVE-2021-30165 1 Edimax 2 Ic-3140w, Ic-3140w Firmware 2024-11-21 7.5 High
The default administrator account & password of the EDIMAX wireless network camera is hard-coded. Remote attackers can disassemble firmware to obtain the privileged permission and further control the devices.
CVE-2021-30157 3 Debian, Fedoraproject, Mediawiki 3 Debian Linux, Fedora, Mediawiki 2024-11-21 6.1 Medium
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.
CVE-2021-30154 3 Debian, Fedoraproject, Mediawiki 3 Debian Linux, Fedora, Mediawiki 2024-11-21 6.1 Medium
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are output in HTML unescaped, leading to XSS.
CVE-2021-30151 3 Contribsys, Debian, Redhat 3 Sidekiq, Debian Linux, Satellite 2024-11-21 6.1 Medium
Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
CVE-2021-30150 1 Ocproducts 1 Composr 2024-11-21 6.1 Medium
Composr 10.0.36 allows XSS in an XML script.
CVE-2021-30146 1 Seafile 1 Seafile 2024-11-21 5.4 Medium
Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library functionality."