Export limit exceeded: 380706 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (380706 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-25352 1 Genivia 1 Crystal Live Http Server 2026-04-15 7.5 High
Crystal Live HTTP Server 6.01 contains a directory traversal vulnerability that allows remote attackers to access system files by manipulating URL path segments. Attackers can use multiple '../' sequences to navigate outside the web root and retrieve sensitive configuration files like Windows system files.
CVE-2019-25353 1 Diy Security 1 Foscam Video Management System 2026-04-15 7.5 High
Foscam Video Management System 1.1.4.9 contains a denial of service vulnerability in the username input field that allows attackers to crash the application. Attackers can overwrite the username with a 520-byte buffer of repeated 'A' characters to trigger an application crash during device login.
CVE-2025-55051 2026-04-15 10 Critical
CWE-1392: Use of Default Credentials
CVE-2019-25354 1 Shenzhen Smarteye Digital Electronics 1 Ismartviewpro 2026-04-15 7.5 High
iSmartViewPro 1.3.34 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the camera ID input field. Attackers can paste a 257-character buffer into the camera DID and password fields to trigger an application crash on iOS devices.
CVE-2025-55052 2026-04-15 4.3 Medium
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-55053 2026-04-15 6.5 Medium
CWE-328: Use of Weak Hash
CVE-2019-25356 1 Bematech 1 Mp-4200 2026-04-15 6.1 Medium
Bematech (formerly Logic Controls, now Elgin) MP-4200 TH printer contains a cross-site scripting vulnerability in the admin configuration page. Attackers can inject malicious scripts via crafted POST requests with malformed 'admin' and 'person' parameters, allowing execution of arbitrary JavaScript in the context of an authenticated user's browser session.
CVE-2019-25357 1 Webgate 2 Control Center, Control Center Pro 2026-04-15 8.4 High
Control Center PRO 6.2.9 contains a stack-based buffer overflow vulnerability in the user creation module's username field that allows attackers to overwrite Structured Exception Handler (SEH). Attackers can craft a malicious payload exceeding 664 bytes to inject shellcode and potentially execute arbitrary code on vulnerable Windows systems.
CVE-2019-25358 1 Nikkhokkho 1 Fileoptimizer 2026-04-15 7.5 High
FileOptimizer 14.00.2524 contains a denial of service vulnerability that allows attackers to crash the application by manipulating the FileOptimizer32.ini configuration file. Attackers can overwrite the TempDirectory parameter with a 5000-character buffer to cause the application to crash when opening options.
CVE-2019-25359 1 Sitzungsdienst 1 Sd.net Rim 2026-04-15 8.2 High
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL statements through POST parameters 'idtyp' and 'idgremium'. Attackers can exploit this vulnerability by crafting specially formed POST requests to the /vorlagen/ endpoint, enabling unauthorized database manipulation and potential information disclosure.
CVE-2025-55054 2026-04-15 6.1 Medium
CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
CVE-2019-25361 1 Ayukov 1 Ayukov Nftp Client 2026-04-15 9.8 Critical
Ayukov NFTP client 1.71 contains a buffer overflow vulnerability in the SYST command handling that allows remote attackers to execute arbitrary code. Attackers can send a specially crafted SYST command with oversized payload to trigger a buffer overflow and execute a bind shell on port 5150.
CVE-2025-5500 2 Google, Zhenshi 2 Android, Mibro Fit App 2026-04-15 5.3 Medium
A flaw has been found in ZhenShi Mibro Fit App 1.6.3.17499 on Android. This impacts an unknown function of the file AndroidManifest.xml of the component com.xiaoxun.xunoversea.mibrofit. This manipulation causes improper export of android application components. The attack requires local access. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-55034 1 General Industrial Controls 1 Lynx+ Gateway 2026-04-15 8.2 High
General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login.
CVE-2025-55047 2026-04-15 8.4 High
CWE-798 Use of Hard-coded Credentials
CVE-2025-55048 2026-04-15 9.8 Critical
Multiple CWE-78
CVE-2025-55049 1 Baicells 1 Neutrino 430 2026-04-15 9.1 Critical
Use of Default Cryptographic Key (CWE-1394)
CVE-2025-55050 2026-04-15 9.8 Critical
CWE-1242: Inclusion of Undocumented Features
CVE-2019-25365 1 Chaospro 1 Chaospro 2026-04-15 9.8 Critical
ChaosPro 2.0 contains a buffer overflow vulnerability in the configuration file path handling that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler. Attackers can craft a malicious configuration file with carefully constructed payload to overwrite memory and gain remote code execution on vulnerable Windows XP systems.
CVE-2019-25366 1 Microasp 1 Microasp (portal+) Cms 2026-04-15 8.2 High
microASP Portal+ CMS contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the explode_tree parameter. Attackers can send crafted requests to pagina.phtml with SQL injection payloads using extractvalue and concat functions to extract sensitive database information like the current database name.