Lucene search
+L
NvdMost viewed

398907 matches found

NVD
NVD
•added 2025/09/10 1:15 p.m.•63 views

CVE-2025-10225

Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119 in the OpenSSL-based session module in AxxonSoft Axxon One C-Werk 2.0.6 and earlier on Windows allows a remote attacker under high load conditions to cause application crashes or unpredictable behavior via triggering...

8.7CVSS0.00399EPSS
SaveExploits0References1
NVD
NVD
•added 2025/09/09 11:15 p.m.•63 views

CVE-2025-59042

PyInstaller bundles a Python application and all its dependencies into a single package. Due to a special entry being appended to sys.path during the bootstrap process of a PyInstaller-frozen application, and due to the bootstrap script attempting to load an optional module for bytecode decryptio...

7CVSS0.00123EPSS
SaveExploits0References2
NVD
NVD
•added 2025/07/16 7:15 a.m.•63 views

CVE-2025-52690

Successful exploitation of the vulnerability could allow an attacker to execute arbitrary commands as root, potentially leading to the loss of confidentiality, integrity, availability, and full control of the access point...

8.1CVSS0.11627EPSS
SaveExploits0References3
NVD
NVD
•added 2025/07/14 6:15 p.m.•63 views

CVE-2025-52363

Tenda CP3 Pro Firmware V22.5.4.93 contains a hardcoded root password hash in the /etc/passwd file and /etc/passwd-. An attacker with access to the firmware image can extract and attempt to crack the root password hash, potentially obtaining administrative access...

6.8CVSS0.00207EPSS
SaveExploits1References2
NVD
NVD
•added 2025/07/10 8:15 p.m.•63 views

CVE-2025-7413

A vulnerability classified as critical has been found in code-projects Library System 1.0. This affects an unknown part of the file /user/teacher/profile.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been...

8.8CVSS0.00331EPSS
SaveExploits1References5
NVD
NVD
•added 2025/07/10 9:15 a.m.•63 views

CVE-2025-6168

An issue has been discovered in GitLab EE affecting all versions from 18.0 before 18.0.4 and 18.1 before 18.1.2 that could have allowed authenticated maintainers to bypass group-level user invitation restrictions by sending crafted API requests...

2.7CVSS0.00324EPSS
SaveExploits0References2
NVD
NVD
•added 2025/06/27 2:15 p.m.•63 views

CVE-2025-53311

Cross-Site Request Forgery CSRF vulnerability in Amol Nirmala Waman Navayan Subscribe navayan-subscribe allows Stored XSS.This issue affects Navayan Subscribe: from n/a through = 1.13...

7.1CVSS0.00123EPSS
SaveExploits0References1
NVD
NVD
•added 2025/06/21 2:15 a.m.•63 views

CVE-2025-6394

A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /addreserve.php. The manipulation of the argument firstname leads to sql injection. The attack can be...

9.8CVSS0.00487EPSS
SaveExploits1References5
NVD
NVD
•added 2025/05/28 6:15 a.m.•63 views

CVE-2025-4800

The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stmlmsaddassignmentattachment function in all versions up to, and including, 4.7.0. This makes it possible for authenticated attackers, with Subscriber-level access an...

8.8CVSS0.01119EPSS
SaveExploits0References4
NVD
NVD
•added 2025/05/13 4:15 p.m.•63 views

CVE-2025-46721

nosurf is cross-site request forgery CSRF protection middleware for Go. A vulnerability in versions prior to 1.2.0 allows an attacker who controls content on the target site, or on a subdomain of the target site either via XSS, or otherwise to bypass CSRF checks and issue requests on user's behal...

6.1CVSS0.00232EPSS
SaveExploits2References5
NVD
NVD
•added 2025/05/13 10:15 a.m.•63 views

CVE-2025-40555

A vulnerability has been identified in APOGEE PXC+TALON TC Series BACnet All versions. Affected devices start sending unsolicited BACnet broadcast messages after processing a specific BACnet createObject request. This could allow an attacker residing in the same BACnet network to send a specially...

5.3CVSS0.0021EPSS
SaveExploits0References1
NVD
NVD
•added 2025/04/30 3:16 p.m.•63 views

CVE-2025-46342

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selectors in their match statements are mistakenly not applied during admission review request processing due to a missing error...

8.5CVSS0.00753EPSS
SaveExploits1References2
NVD
NVD
•added 2025/04/24 6:15 p.m.•63 views

CVE-2025-43858

YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe conversion of arguments allows the injection of a malicious commands when starting yt-dlp from a commands prompt running on Windows OS with...

9.2CVSS0.00264EPSS
SaveExploits0References3
NVD
NVD
•added 2025/04/14 3:15 p.m.•63 views

CVE-2025-2424

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation...

4.3CVSS0.00253EPSS
SaveExploits0References1
NVD
NVD
•added 2025/04/09 9:15 a.m.•63 views

CVE-2025-25053

OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

8.8CVSS0.00971EPSS
SaveExploits0References2
NVD
NVD
•added 2025/03/21 6:15 a.m.•63 views

CVE-2025-30345

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chatgroup.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are filtered, whereas others are not. In most cases, HTML entities are encoded properly, but not when...

4.1CVSS0.00283EPSS
SaveExploits1References1
NVD
NVD
•added 2025/03/20 2:15 p.m.•63 views

CVE-2025-29412

A cross-site scripting XSS vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...

4.8CVSS0.00227EPSS
SaveExploits1References2
NVD
NVD
•added 2025/03/11 5:16 p.m.•63 views

CVE-2025-24071

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network...

6.5CVSS0.22915EPSS
SaveExploits23References3
NVD
NVD
•added 2025/01/29 5:15 p.m.•63 views

CVE-2025-24791

snowflake-connector-nodejs is a NodeJS driver for Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake NodeJS Driver. File permissions checks of the temporary credential cache could be bypassed by an attacker with write access to the local cache directory. This...

5.5CVSS0.00146EPSS
SaveExploits0References2
NVD
NVD
•added 2025/01/24 11:15 p.m.•63 views

CVE-2024-50698

SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content...

9.8CVSS0.00573EPSS
SaveExploits0References1
NVD
NVD
•added 2025/01/10 5:15 p.m.•63 views

CVE-2024-57212

TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parameter in the actionreboot function...

5.1CVSS0.00755EPSS
SaveExploits1References1
NVD
NVD
•added 2025/01/05 4:15 p.m.•63 views

CVE-2025-0222

A vulnerability was found in IObit Protected Folder up to 13.6.0.5 and classified as problematic. This issue affects the function 0x8001E000/0x8001E004 in the library IUProcessFilter.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. An attack has to be...

6.8CVSS0.00356EPSS
SaveExploits1References4
NVD
NVD
•added 2025/01/03 4:15 p.m.•63 views

CVE-2024-56320

GoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of access to the admin "Configuration XML" UI feature, and its associated API. A malicious insider/existing authenticated GoCD user with an existing GoCD...

9.4CVSS0.00742EPSS
SaveExploits0References4
NVD
NVD
•added 2025/01/03 4:15 p.m.•63 views

CVE-2024-56408

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 have no sanitization in the /vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php file, which leads to the possibility of a cross-site scripting attack...

8.3CVSS0.00403EPSS
SaveExploits1References5
NVD
NVD
•added 2024/12/20 3:15 a.m.•63 views

CVE-2022-34159

Huawei printers have an input verification vulnerability. Successful exploitation of this vulnerability may cause device service exceptions. Vulnerability ID: HWPSIRT-2022-80078 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2022-34159...

7.5CVSS0.00529EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/17 10:15 p.m.•63 views

CVE-2023-37940

Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...

4.8CVSS0.00278EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/17 3:15 a.m.•63 views

CVE-2020-12487

Due to the flaws in the verification of input parameters, the attacker can input carefully constructed commands to make the ABE service execute some commands with root privilege...

7CVSS0.00269EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/06 7:15 p.m.•63 views

CVE-2024-47791

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x could allow an attacker to subscribe to partial possible topics in Ruijie MQTT broker, and receive partial messages being sent to and from devices...

8.7CVSS0.00392EPSS
SaveExploits0References1
NVD
NVD
•added 2024/12/03 6:15 p.m.•63 views

CVE-2024-41775

IBM Cognos Controller 11.0.0 and 11.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

7.5CVSS0.00212EPSS
SaveExploits0References1
NVD
NVD
•added 2024/11/26 2:15 p.m.•63 views

CVE-2024-11699

Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox 133, Firefox ESR...

8.8CVSS0.00682EPSS
SaveExploits0References6
NVD
NVD
•added 2024/11/26 12:15 p.m.•63 views

CVE-2023-1521

On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LDPRELOAD. If the server is run as root which is the default when installing the snap package https://snapcraft.io/sccache , this means a user...

7.8CVSS0.00363EPSS
SaveExploits2References2
NVD
NVD
•added 2024/11/18 10:15 p.m.•63 views

CVE-2024-52345

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RobertoAlicata raqrcode ra-qrcode allows Stored XSS.This issue affects raqrcode: from n/a through = 2.1.0...

6.5CVSS0.00241EPSS
SaveExploits0References1
NVD
NVD
•added 2024/11/15 9:15 p.m.•63 views

CVE-2024-45611

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can bypass the access control policy to create a private RSS feed attached to another user account and use a malicious payload t...

5.7CVSS0.0031EPSS
SaveExploits0References1
NVD
NVD
•added 2024/11/08 5:15 a.m.•63 views

CVE-2024-21538

Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service ReDoS due to improper input sanitization. An attacker can increase the CPU usage and crash the program by crafting a very large and well crafted string...

8.7CVSS0.00868EPSS
SaveExploits0References5
NVD
NVD
•added 2024/11/01 3:15 p.m.•63 views

CVE-2024-47361

Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through = 1.13.6...

8.8CVSS0.00442EPSS
SaveExploits0References1
NVD
NVD
•added 2024/10/24 6:15 p.m.•63 views

CVE-2024-10337

A vulnerability classified as critical has been found in SourceCodeHero Clothes Recommendation System 1.0. Affected is an unknown function of the file /admin/home.php?con=add. The manipulation of the argument cat/subcat/ t1/t2/text leads to sql injection. It is possible to launch the attack...

7.2CVSS0.00454EPSS
SaveExploits1References3
NVD
NVD
•added 2024/10/15 9:15 p.m.•63 views

CVE-2024-44775

kmqtt v0.2.7 is vulnerable to Denial of Service DoS due to a Null Pointer Exception. A remote attacker can cause the broker to crash by sending a specially crafted MQTT CONNECT packet that triggers an unhandled null reference, leading to an immediate process termination...

7.5CVSS0.00529EPSS
SaveExploits0References1
NVD
NVD
•added 2024/10/04 1:15 p.m.•63 views

CVE-2024-47654

This vulnerability exists in Shilpi Client Dashboard due to lack of rate limiting and Captcha protection for OTP requests in certain API endpoint. An unauthenticated remote attacker could exploit this vulnerability by sending multiple OTP request through vulnerable API endpoints, which could lead...

7.5CVSS0.00492EPSS
SaveExploits0References1
NVD
NVD
•added 2024/10/01 8:15 a.m.•63 views

CVE-2024-8548

The KB Support – WordPress Help Desk and Knowledge Base plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the /includes/ajax-functions.php file all versions up to, and including, 1.6.6. This makes it possible...

8.1CVSS0.0036EPSS
SaveExploits0References2
NVD
NVD
•added 2024/09/20 12:15 a.m.•63 views

CVE-2024-45807

Envoy is a cloud-native high-performance edge/middle/service proxy. Envoy's 1.31 is using oghttp as the default HTTP/2 codec, and there are potential bugs around stream management in the codec. To resolve this Envoy will switch off the oghttp2 by default. The impact of this issue is that envoy wi...

7.5CVSS0.00495EPSS
SaveExploits0References1
NVD
NVD
•added 2024/09/10 5:15 p.m.•63 views

CVE-2024-21416

Windows TCP/IP Remote Code Execution Vulnerability...

9.8CVSS0.01381EPSS
SaveExploits0References1
NVD
NVD
•added 2024/09/09 7:15 p.m.•63 views

CVE-2024-7341

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

7.1CVSS0.00848EPSS
SaveExploits0References12
NVD
NVD
•added 2024/08/27 8:15 p.m.•63 views

CVE-2024-8212

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as critical. This issue...

9.8CVSS0.07482EPSS
SaveExploits1References6
NVD
NVD
•added 2024/08/27 7:15 p.m.•63 views

CVE-2024-8210

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been classified as critical. This...

9.8CVSS0.07482EPSS
SaveExploits1References6
NVD
NVD
•added 2024/08/22 2:15 a.m.•63 views

CVE-2021-4441

In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynqqspiexecmemop In zynqqspiexecmemop, kzalloc is directly used in memset, which could lead to a NULL pointer dereference on failure of kzalloc. Fix this bug by adding a chec...

5.5CVSS0.00225EPSS
SaveExploits0References5
NVD
NVD
•added 2024/08/06 10:15 p.m.•63 views

CVE-2024-38206

An authenticated attacker can bypass Server-Side Request Forgery SSRF protection in Microsoft Copilot Studio to leak sensitive information over a network...

8.5CVSS0.12341EPSS
SaveExploits0References1
NVD
NVD
•added 2024/08/06 9:16 p.m.•63 views

CVE-2024-41270

An issue discovered in the RunHTTPServer function in Gorush v1.18.4 allows attackers to intercept and manipulate data due to use of deprecated TLS version...

9.1CVSS0.00308EPSS
SaveExploits0References1
NVD
NVD
•added 2024/07/26 8:15 p.m.•63 views

CVE-2024-41112

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 380, leading to remote code execution. Commit...

9.8CVSS0.01395EPSS
SaveExploits1References4
NVD
NVD
•added 2024/07/17 8:15 a.m.•63 views

CVE-2024-39877

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

8.8CVSS0.01726EPSS
SaveExploits0References3
NVD
NVD
•added 2024/07/15 8:15 a.m.•63 views

CVE-2023-46801

In Apache Linkis = 1.8.0241. Or users upgrade Linkis to version 1.6.0...

8.8CVSS0.01228EPSS
SaveExploits0References2
Total number of security vulnerabilities5000