Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,490
- Last 24h
- 549
- Critical, 7 days
- 337
- Known exploited
- 1,779
35,523 results · Clear filters · Feed
-
Critical 10.0CVE-2023-25813 Public exploit
SQL Injection via replacements in sequelize
Sequelize is a Node.js ORM tool. In versions prior to 6.19.1 a SQL injection exploit exists related to replacements. Parameters which are passed through replacements are not properly escaped which can lead to arbitrary SQL injection depending on the specific …
-
High 7.3CVE-2023-0963 Public exploit
SourceCodester Music Gallery Site POST Request Users.php access control
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been rated as critical. This issue affects some unknown processing of the file Users.php of the component POST Request Handler. The manipulation leads to improper access controls. The …
-
Medium 6.3CVE-2023-0962 Public exploit
SourceCodester Music Gallery Site GET Request Master.php sql injection
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been declared as critical. This vulnerability affects unknown code of the file Master.php of the component GET Request Handler. The manipulation of the argument id leads to sql injecti…
-
Medium 6.3CVE-2023-0961 Public exploit
SourceCodester Music Gallery Site GET Request view_music_details.php sql injection
A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file view_music_details.php of the component GET Request Handler. The manipulation of the argument id leads to sql inje…
-
Unscored —CVE-2023-22974 Public exploit
A Path Traversal in setup.php in OpenEMR < 7.0.0 allows remote unauthenticated users to read arbitrary files by control…
-
High 8.8CVE-2022-45600 Public exploit
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attacker…
-
Critical 9.8CVE-2022-45599 Public exploit
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, a…
-
Critical 9.8
Unfiltered SQL Injection Vulnerabilities in Geoserver
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS)…
-
Medium 4.7CVE-2023-0943 Public exploit
SourceCodester Best POS Management System Image save_settings unrestricted upload
A vulnerability, which was classified as problematic, has been found in SourceCodester Best POS Management System 1.0. This issue affects the function save_settings of the file index.php?page=site_settings of the component Image Handler. The manipulation of t…
-
Medium 6.3CVE-2023-0938 Public exploit
SourceCodester Music Gallery Site GET Request music_list.php sql injection
A vulnerability classified as critical has been found in SourceCodester Music Gallery Site 1.0. This affects an unknown part of the file music_list.php of the component GET Request Handler. The manipulation of the argument cid leads to sql injection. It is po…
-
High 7.5
Apache Commons FileUpload, Apache Tomcat: FileUpload DoS with excessive parts
Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new c…
-
Medium 6.3CVE-2023-0916 Public exploit
SourceCodester Auto Dealer Management System Users.php access control
A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /adms/classes/Users.php. The manipulation leads to improper access controls. The attac…
-
Medium 6.3CVE-2023-0915 Public exploit
SourceCodester Auto Dealer Management System sql injection
A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. Affected is an unknown function of the file /adms/admin/?page=user/manage_user. The manipulation of the argument id leads to sql injection. It is possib…
-
Medium 4.7CVE-2023-0913 Public exploit
SourceCodester Auto Dealer Management System sql injection
A vulnerability classified as critical was found in SourceCodester Auto Dealer Management System 1.0. This vulnerability affects unknown code of the file /adms/admin/?page=vehicles/sell_vehicle. The manipulation of the argument id leads to sql injection. The …
-
Medium 4.7CVE-2023-0912 Public exploit
SourceCodester Auto Dealer Management System sql injection
A vulnerability classified as critical has been found in SourceCodester Auto Dealer Management System 1.0. This affects an unknown part of the file /adms/admin/?page=vehicles/view_transaction. The manipulation of the argument id leads to sql injection. It is …
-
High 7.3CVE-2023-0905 Public exploit
SourceCodester Employee Task Management System changePasswordForEmployee.php improper authentication
A vulnerability classified as critical has been found in SourceCodester Employee Task Management System 1.0. Affected is an unknown function of the file changePasswordForEmployee.php. The manipulation leads to improper authentication. It is possible to launch…
-
Medium 6.3CVE-2023-0904 Public exploit
SourceCodester Employee Task Management System task-details.php sql injection
A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file task-details.php. The manipulation of the argument task_id leads to sql injection. The attac…
-
Low 3.5CVE-2023-0902 Public exploit
SourceCodester Simple Food Ordering System process_order.php cross site scripting
A vulnerability was found in SourceCodester Simple Food Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file process_order.php. The manipulation of the argument order leads to cross site scripting. It is possibl…
-
Medium 5.4CVE-2022-40348 Public exploit
Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'e…
-
Critical 9.8
IBM Aspera Faspex code execution
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to e…
KEV Feb 21, 2023 -
Medium 5.5CVE-2023-0482 Public exploit
Insecure Temporary File in RESTEasy
In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
-
High 8.8
Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the …
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
Critical 9.8CVE-2023-23279 Public exploit
Canteen Management System 1.0 is vulnerable to SQL Injection via /php_action/getOrderReport.php.
-
Medium 5.3
Adobe Connect Improper Access Control Security feature bypass
Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the integrity of a minor feature…
-
High 8.8
Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature.
-
Critical 9.8
SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parame…
-
Critical 9.8CVE-2022-40347 Public exploit
SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptTyp…
-
Medium 6.5CVE-2021-33104 Public exploit
Improper access control in the Intel(R) OFU software before version 14.1.28 may allow an authenticated user to potentia…
-
Critical 9.8
A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, …
-
Critical 9.3
Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 …
-
Medium 5.3
[20230201] - Core - Improper access check in webservice endpoints
An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.
KEV Jan 8, 2024 -
Medium 5.3CVE-2023-20052 Public exploit
On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the DMG f…
-
Medium 6.0CVE-2023-20075 Public exploit
Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitra…
-
Medium 6.5CVE-2023-20009 Public exploit
A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway (ESA) and Cisco Secure Email and…
-
High 7.2
Authenticated Command Injection in NetModule NSRW
NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 be…
-
High 7.8CVE-2023-0860 Public exploit
Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installer
Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
-
Critical 9.8
Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 80…
-
Medium 6.1CVE-2022-45436 Public exploit
Stored cross-site scripting vulnerability in network maps editor feature
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cross-Site Scripting (XSS). As a manager privilege user , create a network map containing name as xss p…
-
Medium 6.4CVE-2022-47373 Public exploit
Reflected Cross Site Scripting in Search Functionality of Module Library
Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus resul…