35,538 results · Clear filters · Feed
-
High 7.2
Command Injection in froxlor/froxlor
Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.
-
Medium 4.6CVE-2018-25075 Public exploit
karsany OBridge ProcedureDao.java getAllStandaloneProcedureAndFunction sql injection
A vulnerability classified as critical has been found in karsany OBridge up to 1.3. Affected is the function getAllStandaloneProcedureAndFunction of the file obridge-main/src/main/java/org/obridge/dao/ProcedureDao.java. The manipulation leads to sql injection…
-
High 8.1
Netdata vulnerable to command injection
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the functi…
-
Critical 9.8
Code Injection in pyload/pyload
Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.
-
High 8.8CVE-2023-22493 Public exploit
RSSHub is vulnerable to SSRF (Server-Side Request Forgery)
RSSHub is an open source RSS feed generator. RSSHub is vulnerable to Server-Side Request Forgery (SSRF) attacks. This vulnerability allows an attacker to send arbitrary HTTP requests from the server to other servers or resources on the network. An attacker ca…
-
Critical 9.8CVE-2022-45299 Public exploit
webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL
An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.
-
High 7.2CVE-2022-4616 Public exploit
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis …
-
High 7.8CVE-2022-46623 Public exploit
Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
-
High 7.5CVE-2022-46463 Public exploit
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories wit…
-
Medium 6.1CVE-2022-46622 Public exploit
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web …
-
Medium 6.1CVE-2022-45729 Public exploit
A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute a…
-
Medium 6.1CVE-2022-45728 Public exploit
Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
-
Medium 5.4CVE-2022-47102 Public exploit
A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute …
-
Critical 9.1CVE-2022-3782 Public exploit
Keycloak vulnerable to path traversal via double URL encoding
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and pote…
-
High 8.8
In SugarCRM before 12.0. Hotfix 91155, a crafted request can inject custom PHP code through the EmailTemplates because …
KEV Feb 2, 2023 -
Medium 5.5CVE-2022-4543 Public exploit
A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local att…
-
High 7.1CVE-2023-21752 Public exploit
Windows Backup Service Elevation of Privilege Vulnerability
Windows Backup Service Elevation of Privilege Vulnerability
-
Medium 4.7CVE-2023-21766 Public exploit
Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter Information Disclosure Vulnerability
-
Medium 6.8CVE-2023-21563 Public exploit
BitLocker Security Feature Bypass Vulnerability
BitLocker Security Feature Bypass Vulnerability
-
High 7.8CVE-2023-21746 Public exploit
Windows NTLM Elevation of Privilege Vulnerability
Windows NTLM Elevation of Privilege Vulnerability
-
High 7.8CVE-2023-21537 Public exploit
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability
-
High 8.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Microsoft SharePoint Server Remote Code Execution Vulnerability
-
High 8.8
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
KEV Jan 10, 2023 -
High 7.0CVE-2023-21739 Public exploit
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Windows Bluetooth Driver Elevation of Privilege Vulnerability
-
High 7.8
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
-
Medium 6.6CVE-2023-21560 Public exploit
Windows Boot Manager Security Feature Bypass Vulnerability
Windows Boot Manager Security Feature Bypass Vulnerability
-
Medium 5.5CVE-2015-10034 Public exploit
j-nowak workout-organizer sql injection
A vulnerability has been found in j-nowak workout-organizer and classified as critical. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as 13cd6c3d1210640bfdb39872b2bb3597aa991279. It is recommended to…
-
Low 3.5CVE-2017-20165 Public exploit
debug-js debug node.js useColors redos
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version …
-
High 7.2CVE-2022-43973 Public exploit
Arbitrary code execution in Linksys WRT54GL
An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticate…
-
Critical 9.8CVE-2022-39073 Public exploit
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an at…
-
Medium 6.1CVE-2022-44870 Public exploit
A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary …
-
High 8.8
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution b…
-
Medium 5.3CVE-2023-22622 Public exploit
WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting securit…
-
Critical 9.8
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execu…
KEV Jan 17, 2023 -
High 8.1CVE-2022-38766 Public exploit
The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for …
-
High 7.5
Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File Access
The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server
-
Critical 9.8CVE-2022-4297 Public exploit
WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLi
The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection
-
Critical 9.3
A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0…
KEV Dec 13, 2022 -
Unscored —CVE-2022-0337 Public exploit
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote atta…
-
Unscored —
Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, Tre…