Search

Expected end of text, found ',' (at char 45), (line:1, col:46)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357265 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-47294 1 Huawei 2 Emui, Harmonyos 2024-10-01 4.4 Medium
Access permission verification vulnerability in the input method framework module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2024-47293 1 Huawei 2 Emui, Harmonyos 2024-10-01 4.7 Medium
Out-of-bounds write vulnerability in the HAL-WIFI module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2024-47292 1 Huawei 2 Emui, Harmonyos 2024-10-01 6.2 Medium
Path traversal vulnerability in the Bluetooth module Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2024-47291 1 Huawei 2 Emui, Harmonyos 2024-10-01 5.6 Medium
Permission vulnerability in the ActivityManagerService (AMS) module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2024-47290 1 Huawei 2 Emui, Harmonyos 2024-10-01 5.5 Medium
Input validation vulnerability in the USB service module Impact: Successful exploitation of this vulnerability may affect availability.
CVE-2024-8725 2 Advancedfilemanager, Modalweb 2 Advanced File Manager, Advanced File Manager 2024-10-01 6.8 Medium
Multiple plugins and/or themes for WordPress are vulnerable to Limited File Upload in various versions. This is due to a lack of proper checks to ensure lower-privileged roles cannot upload .css and .js files to arbitrary directories. This makes it possible for authenticated attackers, with Subscriber-level access and above, and granted permissions by an administrator, to upload .css and .js files to any directory within the WordPress root directory, which could lead to Stored Cross-Site Scripting. The Advanced File Manager Shortcodes plugin must be installed to exploit this vulnerability.
CVE-2024-46839 1 Redhat 1 Enterprise Linux 2024-10-01 5.5 Medium
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2024-9117 1 Mapplic 1 Mapplic 2024-10-01 6.4 Medium
The Mapplic Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVE-2024-9115 1 Chetanvaghela 1 Common Tools For Site 2024-10-01 6.4 Medium
The Common Tools for Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file.
CVE-2022-4541 2 Nitinmaurya, Nitinmaurya12 2 Wordpress Visitors, Wordpress Visitors 2024-10-01 7.2 High
The WordPress Visitors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a spoofed HTTP Header value in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the nm_vistior page.
CVE-2024-9025 2 Codesupply, Codesupplyco 2 Sight, Sight Professional Image Gallery And Portfolio 2024-10-01 5.3 Medium
The Sight – Professional Image Gallery and Portfolio plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handler_post_title' function in all versions up to, and including, 1.1.2. This makes it possible for unauthenticated attackers to expose private, pending, trashed, and draft post titles. Successful exploitation requires the Elementor plugin to be installed and activated.
CVE-2024-9297 1 Oretnom23 1 Railway Reservation System 2024-10-01 6.3 Medium
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/. The manipulation of the argument page with the input trains/schedules/system_info leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9298 1 Oretnom23 1 Railway Reservation System 2024-10-01 4.3 Medium
A vulnerability was found in SourceCodester Online Railway Reservation System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /?page=tickets of the component Ticket Handler. The manipulation of the argument id leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9299 1 Oretnom23 1 Railway Reservation System 2024-10-01 3.5 Low
A vulnerability classified as problematic has been found in SourceCodester Online Railway Reservation System 1.0. This affects an unknown part of the file /?page=reserve. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9300 2 Oretnom23, Sourcecodester 2 Railway Reservation System, Online Railway Reservation System 2024-10-01 4.3 Medium
A vulnerability classified as problematic was found in SourceCodester Online Railway Reservation System 1.0. This vulnerability affects unknown code of the file contact_us.php of the component Message Us Form. The manipulation of the argument fullname/email/message leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9315 1 Oretnom23 1 Employee And Visitor Gate Pass Logging System 2024-10-01 6.3 Medium
A vulnerability was found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_department.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9317 2 Oretnom23, Sourcecodester 2 Online Eyewear Shop, Online Eyewear Shop 2024-10-01 6.3 Medium
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9318 2 Mayurik, Sourcecodester 2 Advocate Office Management System, Advocate Office Management System 2024-10-01 6.3 Medium
A vulnerability, which was classified as critical, has been found in SourceCodester Advocate Office Management System 1.0. Affected by this issue is some unknown functionality of the file /control/activate.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9319 2 Rems, Sourcecodester 2 Online Timesheet App, Online Timesheet 2024-10-01 6.3 Medium
A vulnerability, which was classified as critical, was found in SourceCodester Online Timesheet App 1.0. This affects an unknown part of the file /endpoint/delete-timesheet.php. The manipulation of the argument timesheet leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-9320 2 Rems, Sourcecodester 2 Online Timesheet App, Online Timesheet 2024-10-01 3.5 Low
A vulnerability has been found in SourceCodester Online Timesheet App 1.0 and classified as problematic. This vulnerability affects unknown code of the file /endpoint/add-timesheet.php of the component Add Timesheet Form. The manipulation of the argument day/task leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.