Lucene search
+L
NvdMost viewed

378749 matches found

NVD
NVD
added 2026/05/12 3:16 a.m.73 views

CVE-2026-40129

Due to a Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform, an authenticated attacker could send specially crafted inputs to the application. If processed by the application, this input could be delivered to users subscribed to the channel and result ...

4.3CVSS0.00255EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/08 1:16 p.m.73 views

CVE-2022-50994

DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the formpassword parameter. Attackers can exploit...

9.2CVSS0.01432EPSS
SaveExploits0References3
NVD
NVD
added 2025/07/26 4:16 a.m.73 views

CVE-2025-54412

skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFuncNode which can be exploited to hide the execution of untrusted operator methods. This can then be used in a code reuse attack to invoke...

8.7CVSS0.00137EPSS
SaveExploits0References3
NVD
NVD
added 2025/07/09 4:15 p.m.73 views

CVE-2025-53673

Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system...

6.5CVSS0.002EPSS
SaveExploits0References2
NVD
NVD
added 2025/04/16 8:15 a.m.73 views

CVE-2025-27538

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...

2.7CVSS0.0023EPSS
SaveExploits0References1
NVD
NVD
added 2025/02/03 10:15 p.m.73 views

CVE-2025-23210

phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting XSS sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1....

4.8CVSS0.00407EPSS
SaveExploits0References2
NVD
NVD
added 2025/01/21 4:15 p.m.73 views

CVE-2025-24011

Umbraco is a free and open source .NET content management system. Starting in version 14.0.0 and prior to versions 14.3.2 and 15.1.2, it's possible to determine whether an account exists based on an analysis of response codes and timing of Umbraco management API responses. Versions 14.3.2 and...

5.3CVSS0.01506EPSS
SaveExploits1References3
NVD
NVD
added 2024/11/18 4:15 p.m.73 views

CVE-2024-0012

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

9.8CVSS0.99698EPSS
SaveExploits15References4
NVD
NVD
added 2024/07/21 8:15 a.m.73 views

CVE-2024-6944

A vulnerability was found in ZhongBangKeJi CRMEB up to 5.4.0 and classified as critical. Affected by this issue is the function getimagebase64 of the file PublicController.php. The manipulation of the argument file leads to deserialization. The attack may be launched remotely. The exploit has bee...

7.5CVSS0.0378EPSS
SaveExploits0References4
NVD
NVD
added 2024/06/27 9:15 p.m.73 views

CVE-2024-2973

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running i...

10CVSS0.01088EPSS
SaveExploits0References2
NVD
NVD
added 2024/06/13 8:15 p.m.73 views

CVE-2024-5947

Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to...

6.5CVSS0.02418EPSS
SaveExploits3References1
NVD
NVD
added 2024/05/23 5:15 p.m.73 views

CVE-2024-35082

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml...

6.3CVSS7.8AI score0.00254EPSS
SaveExploits0References2
NVD
NVD
added 2024/03/15 1:15 p.m.73 views

CVE-2023-6725

An access-control flaw was found in the OpenStack Designate component where private configuration information including access keys to BIND were improperly made world readable. A malicious attacker with access to any container could exploit this flaw to access sensitive information...

5.5CVSS6.2AI score0.00201EPSS
SaveExploits0References4
NVD
NVD
added 2024/01/19 6:15 p.m.73 views

CVE-2024-22955

swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576...

7.8CVSS7.7AI score0.00331EPSS
SaveExploits1References1
NVD
NVD
added 2024/01/09 10:15 a.m.73 views

CVE-2023-42797

A vulnerability has been identified in CP-8031 MASTER MODULE All versions CPCI85 V05.20, CP-8050 MASTER MODULE All versions CPCI85 V05.20. The network configuration service of affected devices contains a flaw in the conversion of ipv4 addresses that could lead to an uninitialized variable being...

7.2CVSS6.5AI score0.00547EPSS
SaveExploits0References1
NVD
NVD
added 2023/06/12 6:15 p.m.73 views

CVE-2023-2362

The Float menu WordPress plugin before 5.0.2, Bubble Menu WordPress plugin before 3.0.4, Button Generator WordPress plugin before 2.3.5, Calculator Builder WordPress plugin before 1.5.1, Counter Box WordPress plugin before 1.2.2, Floating Button WordPress plugin before 5.3.1, Herd Effects WordPre...

6.1CVSS6AI score0.00458EPSS
SaveExploits2References1
NVD
NVD
added 2023/05/08 9:15 p.m.73 views

CVE-2023-30334

AsmBB v2.9.1 was discovered to contain multiple cross-site scripting XSS vulnerabilities via the MiniMag.asm and bbcode.asm libraries...

6.1CVSS6.2AI score0.00624EPSS
SaveExploits1References5
NVD
NVD
added 2023/04/13 11:15 p.m.73 views

CVE-2023-1326

A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate...

7.8CVSS7.8AI score0.00874EPSS
SaveExploits0References2
NVD
NVD
added 2023/03/30 7:15 p.m.73 views

CVE-2023-28647

Nextcloud iOS is an ios application used to interface with the nextcloud home cloud ecosystem. In versions prior to 4.7.0 when an attacker has physical access to an unlocked device, they may enable the integration into the iOS Files app and bypass the Nextcloud pin/password protection and gain...

6.8CVSS4.8AI score0.00278EPSS
SaveExploits0References2
NVD
NVD
added 2023/02/21 3:15 p.m.73 views

CVE-2023-0934

Cross-site Scripting XSS - Stored in GitHub repository answerdev/answer prior to 1.0.5...

6.3CVSS5.4AI score0.00393EPSS
SaveExploits1References2
NVD
NVD
added 2023/02/13 8:15 p.m.73 views

CVE-2023-25718

In ConnectWise Control through 22.9.10032 formerly known as ScreenConnect, after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a different attacker-controlled executable file. It is...

9.8CVSS8.7AI score0.00685EPSS
SaveExploits0References5
NVD
NVD
added 2022/11/14 9:15 p.m.73 views

CVE-2022-37109

patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt file is not properly restricted as it is in the root directory served by StaticFileHandler and the Tornado rule to throw a 403 error when...

9.8CVSS0.49482EPSS
SaveExploits3References4
NVD
NVD
added 2022/01/12 7:15 p.m.73 views

CVE-2021-43960

Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title,...

4.8CVSS0.00592EPSS
SaveExploits1References2
NVD
NVD
added 2021/06/18 10:15 p.m.73 views

CVE-2021-33186

SerenityOS in test-crypto.cpp contains a stack buffer overflow which could allow attackers to obtain sensitive information...

7.5CVSS0.01019EPSS
SaveExploits0References1
NVD
NVD
added 2021/04/13 8:15 p.m.73 views

CVE-2021-28471

Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability...

7.8CVSS0.04075EPSS
SaveExploits0References1
NVD
NVD
added 2021/01/08 6:15 p.m.73 views

CVE-2020-17504

The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters...

7.2CVSS7.5AI score0.02848EPSS
SaveExploits0References3
NVD
NVD
added 2020/05/18 10:15 p.m.73 views

CVE-2020-13154

Zoho ManageEngine Service Plus before 11.1 build 11112 allows low-privilege authenticated users to discover the File Protection password via a getFileProtectionSettings call to AjaxServlet...

6.5CVSS6.3AI score0.03118EPSS
SaveExploits1References2
NVD
NVD
added 2019/08/20 8:15 p.m.73 views

CVE-2019-13520

Multiple buffer overflow issues have been identified in Alpha5 Smart Loader: All versions prior to 4.2. An attacker could use specially crafted project files to overflow the buffer and execute code under the privileges of the application...

7.8CVSS8AI score0.02947EPSS
SaveExploits0References3
NVD
NVD
added 2019/07/18 1:15 p.m.73 views

CVE-2019-1010096

DomainMOD v4.10.0 is affected by: Cross Site Request Forgery CSRF. The impact is: There is a CSRF vulnerability that can change the read-only user to admin. The component is: admin/users/edit.php?uid=2. The attack vector is: After the administrator logged in, open the html page...

8.8CVSS8.7AI score0.0065EPSS
SaveExploits1References1
NVD
NVD
added 2009/09/01 6:30 p.m.73 views

CVE-2009-3042

SQL injection vulnerability in machine.php in Open Computer and Software OCS Inventory NG 1.02.1 allows remote attackers to execute arbitrary SQL commands via the systemid parameter, a different vector than CVE-2009-3040...

7.5CVSS8.2AI score0.02958EPSS
SaveExploits1References5
NVD
NVD
added 2026/05/14 4:17 a.m.72 views

CVE-2026-46446

SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to cpassword = '%@' in changePasswordForLogin...

7.1CVSS0.00239EPSS
SaveExploits0References3
NVD
NVD
added 2026/05/06 1:16 p.m.72 views

CVE-2026-40562

Gazelle versions through 0.49 for Perl allows HTTP Request Smuggling via Improper Header Precedence. Gazelle incorrectly prioritizes "Content-Length" over "Transfer-Encoding: chunked" when both headers are present in an HTTP request. Per RFC 7230 3.3.3, Transfer-Encoding must take precedence. An...

7.5CVSS0.00319EPSS
SaveExploits0References4
NVD
NVD
added 2026/01/07 5:16 p.m.72 views

CVE-2026-20026

Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an interruption of packet inspection. This vulnerabili...

5.8CVSS0.00645EPSS
SaveExploits0References1
NVD
NVD
added 2025/05/29 4:15 p.m.72 views

CVE-2025-48472

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, there is no check to ensure that the user is disabling notifications for the mailbox to which they already have access. Moreover, the code explicitly implements functionality that if the user does not have...

8.1CVSS0.00351EPSS
SaveExploits1References2
NVD
NVD
added 2025/04/28 8:15 p.m.72 views

CVE-2025-31651

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. For a subset of unlikely rewrite rule configurations, it was possible for a specially crafted request to bypass some rewrite rules. If those rewrite rules effectively enforced security constraints, those...

9.8CVSS0.04047EPSS
SaveExploits1References3
NVD
NVD
added 2024/11/18 10:15 p.m.72 views

CVE-2024-52342

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Offshorent Solutions Pvt Ltd OS BXSlider os-bxslider allows Stored XSS.This issue affects OS BXSlider: from n/a through = 2.6...

6.5CVSS0.00231EPSS
SaveExploits0References1
NVD
NVD
added 2024/07/01 7:15 p.m.72 views

CVE-2024-36387

Serving WebSocket protocol upgrades over a HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance...

5.4CVSS0.01715EPSS
SaveExploits0References3
NVD
NVD
added 2024/06/21 10:15 a.m.72 views

CVE-2024-31890

IBM i 7.3, 7.4, and 7.5 product IBM TCP/IP Connectivity Utilities for i contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain root access to the host operating system. IBM X-Force ID: 288171...

7.8CVSS0.00171EPSS
SaveExploits0References2
NVD
NVD
added 2024/06/18 9:15 p.m.72 views

CVE-2024-6129

A vulnerability, which was classified as problematic, was found in spa-cartcms 1.9.0.6. Affected is an unknown function of the file /login of the component Username Handler. The manipulation of the argument email leads to observable behavioral discrepancy. It is possible to launch the attack...

6.3CVSS0.00605EPSS
SaveExploits1References4
NVD
NVD
added 2024/05/18 6:15 a.m.72 views

CVE-2024-3812

The Salient Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.7 via the 'nectaricon' shortcode 'iconlinea' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

7.5CVSS7.8AI score0.00632EPSS
SaveExploits0References2
NVD
NVD
added 2024/05/01 6:15 a.m.72 views

CVE-2024-27018

In the Linux kernel, the following vulnerability has been resolved: netfilter: brnetfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input hook path. This patch adds a workaroun...

8.2CVSS7.2AI score0.00633EPSS
SaveExploits0References8
NVD
NVD
added 2024/04/29 5:15 p.m.72 views

CVE-2024-33444

SQL injection vulnerability in onethink v.1.1 allows a remote attacker to escalate privileges via a crafted script to the ModelModel.class.php component...

9.8CVSS7.7AI score0.00899EPSS
SaveExploits1References3
NVD
NVD
added 2024/04/11 1:15 p.m.72 views

CVE-2024-32109

Cross-Site Request Forgery CSRF vulnerability in Julien Berthelot / MPEmbed.Com WP Matterport Shortcode allows Cross Site Request Forgery.This issue affects WP Matterport Shortcode: from n/a through 2.1.9...

4.3CVSS4.6AI score0.002EPSS
SaveExploits0References1
NVD
NVD
added 2024/04/04 2:15 p.m.72 views

CVE-2024-2700

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, therefore, running the resulting application inherits the values captured at build time. Some local environment variables may have been...

7CVSS7AI score0.00288EPSS
SaveExploits0References8
NVD
NVD
added 2023/09/27 3:19 p.m.72 views

CVE-2023-4506

The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access an...

6.5CVSS4.4AI score0.00721EPSS
SaveExploits2References4
NVD
NVD
added 2023/09/06 9:15 p.m.72 views

CVE-2023-41327

WireMock is a tool for mocking HTTP services. WireMock can be configured to only permit proxying and therefore recording to certain addresses. This is achieved via a list of allowed address rules and a list of denied address rules, where the allowed list is evaluated first. Until WireMock Webhook...

5.4CVSS5.1AI score0.00469EPSS
SaveExploits0References3
NVD
NVD
added 2022/10/06 6:16 p.m.72 views

CVE-2022-39273

FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the public internet. In an effort to make enabling authentication easier for Flyte administrators, the...

7.5CVSS0.00727EPSS
SaveExploits0References3
NVD
NVD
added 2022/09/08 12:15 a.m.72 views

CVE-2022-38531

FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function...

8.8CVSS0.01917EPSS
SaveExploits1References1
NVD
NVD
added 2022/03/03 9:15 p.m.72 views

CVE-2022-24723

URI.js is a Javascript URL mutation library. Before version 1.19.9, whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly. This issue has been patched in version 1.19.9. Removing leading whitespace from values before passing them to URI.parse ca...

5.3CVSS0.01995EPSS
SaveExploits1References4
NVD
NVD
added 2021/11/10 11:15 p.m.72 views

CVE-2021-33816

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...

9.8CVSS0.03815EPSS
SaveExploits3References3
Total number of security vulnerabilities5000