Lucene search
+L
Vulncheck KevMost viewed

5119 matches found

VulnCheck KEV
VulnCheck KEV
•added 2020/12/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-17496

The PHP module within vBulletin contains an unspecified vulnerability that allows for remote code execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. This CVE ID resolves an incomplete patch for CVE-2019-16759...

9.8CVSS8AI score0.99728EPSS
SaveExploits29References1
VulnCheck KEV
VulnCheck KEV
•added 2020/12/06 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

9.8CVSS7.7AI score0.12605EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2020/12/01 12:00 a.m.•9 views

VulnCheck KEV: CVE-2005-2773

HP OpenView Network Node Manager could allow a remote attacker to execute arbitrary commands on the system...

9.8CVSS7.6AI score0.7409EPSS
SaveExploits10References1
VulnCheck KEV
VulnCheck KEV
•added 2020/11/22 12:00 a.m.•9 views

VulnCheck KEV: CVE-2019-9194

elFinder before 2.1.48 has a command injection vulnerability in the PHP connector...

9.8CVSS7.3AI score0.96669EPSS
SaveExploits11References1
VulnCheck KEV
VulnCheck KEV
•added 2020/11/11 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-3992

VMware ESXi OpenSLP contains a use-after-free vulnerability that allows an attacker residing in the management network with access to port 427 to perform remote code execution...

10CVSS7.6AI score0.83015EPSS
SaveExploits3References1
VulnCheck KEV
VulnCheck KEV
•added 2020/10/22 12:00 a.m.•9 views

VulnCheck KEV: CVE-2025-34054

An unauthenticated command injection vulnerability exists in AVTECH DVR devices via Search.cgi?action=cgiquery. The use of wget without input sanitization allows attackers to inject shell commands through the username or queryb64str parameters, executing commands as root. Exploitation evidence...

10CVSS5.8AI score0.02731EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2020/10/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-3118

Cisco IOS XR improperly validates string input from certain fields in Cisco Discovery Protocol messages. Exploitation could allow an unauthenticated, adjacent attacker to execute code with administrative privileges or cause a reload on an affected device...

8.8CVSS7.5AI score0.11685EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2020/10/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-6327

Symantec Messaging Gateway contains an unspecified vulnerability which can allow for remote code execution. With the ability to perform remote code execution, an attacker may also desire to perform privilege escalating actions...

8.8CVSS7.5AI score0.35341EPSS
SaveExploits7References1
VulnCheck KEV
VulnCheck KEV
•added 2020/09/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2008-4873

board.cgi in Sepal SPBOARD 4.5 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter during a downfile action...

10CVSS6.1AI score0.04929EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2020/07/07 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-36705

The Adning Advertising plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ninguploadimage function in versions up to, and including, 1.5.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected...

9.8CVSS7.4AI score0.06944EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2020/04/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-1020

Microsoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts Adobe Type 1 PostScript format that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who...

8.8CVSS7.5AI score0.65037EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2020/04/03 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-8515

DrayTek Vigor3900, Vigor2960, and Vigor300B routers contain an unspecified vulnerability that allows for remote code execution...

10CVSS7.6AI score0.99993EPSS
SaveExploits7References1
VulnCheck KEV
VulnCheck KEV
•added 2020/03/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2025-34130

An unauthenticated arbitrary file read exists in LILIN Digital Video Recorder DVR devices prior to firmware version 2.0b6020200207 via the /z/zbin/nethtml.cgi endpoint. This vulnerability allows attackers to read sensitive configuration files, such as /zconf/service.xml, which can then be...

8.7CVSS5.9AI score0.01149EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2020/01/22 12:00 a.m.•9 views

VulnCheck KEV: CVE-2020-0650

A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0651, CVE-2020-0653...

9.3CVSS7.8AI score0.20398EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2019/12/17 12:00 a.m.•9 views

VulnCheck KEV: CVE-2019-14927

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote configuration download vulnerability allows an attacker to download the smartRTU's configuration file which contains data such as usernames,...

7.5CVSS7.1AI score0.41847EPSS
SaveExploits3References1
VulnCheck KEV
VulnCheck KEV
•added 2019/12/17 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-16608

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within exec.jsp. The issue results from the lack of proper validation of a...

9.8CVSS7.7AI score0.04232EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2019/08/28 12:00 a.m.•9 views

VulnCheck KEV: CVE-2005-0862

Multiple PHP remote file inclusion vulnerabilities in PHPOpenChat 3.0.1 and earlier allow remote attackers to execute arbitrary PHP code via the phpbbrootpath parameter to 1 pocloginform.php or 2 phpbb/poc.php, the pocrootpath parameter to 3 phpbb/poc.php, 4...

7.5CVSS6.1AI score0.10918EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2019/06/18 12:00 a.m.•9 views

VulnCheck KEV: CVE-2019-11707

Mozilla Firefox and Thunderbird contain a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, allowing for an exploitable crash...

8.8CVSS7AI score0.37696EPSS
SaveExploits8References1
VulnCheck KEV
VulnCheck KEV
•added 2019/06/13 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-18377

An issue was discovered on Wireless IP Camera P2P WIFICAM cameras. There is Command Injection in the setftp.cgi script via shell metacharacters in the pwd variable, as demonstrated by a setftp.cgi?svr=192.168.1.1&port=21&user=ftp URI...

10CVSS7.3AI score0.06797EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2019/06/13 12:00 a.m.•9 views

VulnCheck KEV: CVE-2013-7471

An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03, DIR-600 before v2.17b01, DIR-645 before v1.04b11, DIR-300 rev. B, and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient, NewExternalPort, or NewInternalPort...

9.8CVSS7AI score0.23983EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2019/06/13 12:00 a.m.•9 views

VulnCheck KEV: CVE-2009-5157

On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4pingipaddr variable...

9CVSS7.3AI score0.05825EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2019/06/13 12:00 a.m.•9 views

VulnCheck KEV: CVE-2018-14933

NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command...

10CVSS7.5AI score0.94884EPSS
SaveExploits5References1
VulnCheck KEV
VulnCheck KEV
•added 2019/06/12 12:00 a.m.•9 views

VulnCheck KEV: CVE-2019-7238

Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution...

9.8CVSS7.7AI score0.77146EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
•added 2019/04/17 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-12617

When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server...

8.1CVSS7AI score0.99988EPSS
SaveExploits23References1
VulnCheck KEV
VulnCheck KEV
•added 2019/03/19 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-8750

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of...

7.6CVSS7.5AI score0.09202EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2019/03/11 12:00 a.m.•9 views

VulnCheck KEV: CVE-2019-25152

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping...

7.2CVSS6.3AI score0.01364EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2019/02/08 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-18362

ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database...

9.8CVSS7.3AI score0.8682EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2019/02/06 12:00 a.m.•9 views

VulnCheck KEV: CVE-2019-11695

A custom cursor defined by scripting on a site can position itself over the addressbar to spoof the actual cursor when it should not be allowed outside of the primary web content area. This could be used by a malicious site to trick users into clicking on permission prompts, doorhanger...

4.3CVSS6.6AI score0.00737EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2018/10/17 12:00 a.m.•9 views

VulnCheck KEV: CVE-2018-8589

A privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system...

7.8CVSS7.5AI score0.03023EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2018/09/25 12:00 a.m.•9 views

VulnCheck KEV: CVE-2018-25117

VestaCP commit a3f0fa1 2018-05-31 up to commit ee03eff 2018-06-13 contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS...

9.3CVSS5.8AI score0.00411EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2018/09/19 12:00 a.m.•9 views

VulnCheck KEV: CVE-2016-3088

The Fileserver web application in Apache ActiveMQ allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request...

9.8CVSS7.5AI score0.98518EPSS
SaveExploits20References1
VulnCheck KEV
VulnCheck KEV
•added 2018/08/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2018-8414

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths...

9.3CVSS8AI score0.73968EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2018/07/13 12:00 a.m.•9 views

VulnCheck KEV: CVE-2015-7261

The FTP service in QNAP iArtist Lite before 1.4.54, as distributed with QNAP Signage Station before 2.0.1, has hardcoded credentials, which makes it easier for remote attackers to obtain access via a session on TCP port 21...

9.8CVSS7.3AI score0.01598EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2018/01/29 12:00 a.m.•9 views

VulnCheck KEV: CVE-2018-0101

A vulnerability in the Secure Sockets Layer SSL VPN functionality of the Cisco Adaptive Security Appliance ASA Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code. The vulnerability is due to an attempt to double free a...

10CVSS7.3AI score0.8678EPSS
SaveExploits7References1
VulnCheck KEV
VulnCheck KEV
•added 2018/01/15 12:00 a.m.•9 views

VulnCheck KEV: CVE-2012-2336

sapi/cgi/cgimain.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script aka php-cgi, does not properly handle query strings that lack an = equals sign character, which allows remote attackers to cause a denial of service resource consumption by placing...

5CVSS7.3AI score0.50723EPSS
SaveExploits5References1
VulnCheck KEV
VulnCheck KEV
•added 2018/01/15 12:00 a.m.•9 views

VulnCheck KEV: CVE-2012-2335

php-wrapper.fcgi does not properly handle command-line arguments, which allows remote attackers to bypass a protection mechanism in PHP 5.3.12 and 5.4.2 and execute arbitrary code by leveraging improper interaction between the PHP sapi/cgi/cgimain.c component and a query string beginning with...

7.5CVSS7.6AI score0.32542EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2017/11/24 12:00 a.m.•9 views

VulnCheck KEV: CVE-2016-10401

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known or a non-root default account exists within an ISP's deployment of these devices...

9CVSS7.5AI score0.12113EPSS
SaveExploits5References1
VulnCheck KEV
VulnCheck KEV
•added 2017/10/02 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-20206

The Appointments plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.1 via deserialization of untrusted input from the wpmudevappointments cookie. This allows unauthenticated attackers to inject a PHP Object. Attackers were actively exploiting...

9.8CVSS5.8AI score0.00685EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2017/09/18 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-20201

CCleaner v5.33.6162 and CCleaner Cloud v1.07.3191 32-bit builds contained a malicious pre-entry-point loader that diverts execution from scrtcommonmainseh into a custom loader. That loader decodes an embedded blob into shellcode, allocates executable heap memory, resolves Windows API...

9.3CVSS6AI score0.00494EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2017/08/30 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-0059

Microsoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site...

4.3CVSS6.7AI score0.61968EPSS
SaveExploits9References1
VulnCheck KEV
VulnCheck KEV
•added 2017/06/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2009-3103

Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC allows remote attackers to execute arbitrary code or cause a denial of service system crash via an & ampersand character in a...

10CVSS7.7AI score0.90227EPSS
SaveExploits25References1
VulnCheck KEV
VulnCheck KEV
•added 2017/06/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2001-0690

Format string vulnerability in exim 3.22-10 in Red Hat, 3.12 in Debian and 3.16 in Conectiva in batched SMTP mode allows a remote attacker to execute arbitrary code via format strings in SMTP mail headers...

7.5CVSS6.2AI score0.11891EPSS
SaveExploits3References1
VulnCheck KEV
VulnCheck KEV
•added 2017/06/20 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-5613

Format string vulnerability in cgiemail and cgiecho allows remote attackers to execute arbitrary code via format string specifiers in a template file...

7.8CVSS7.5AI score0.0256EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2017/06/13 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-8543

Microsoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory...

10CVSS6.9AI score0.64856EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2017/04/01 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-2404

An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the "Quick Look" component. It allows remote attackers to trigger telephone calls to arbitrary numbers via a tel: URL in a PDF document, as exploited in the wild in October 2016...

7.5CVSS7.3AI score0.01436EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2017/03/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-0149

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service DoS via a crafted website...

8.8CVSS7.3AI score0.29189EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
•added 2017/03/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-0143

Microsoft Windows Server Message Block 1.0 SMBv1 contains an unspecified vulnerability that allows for remote code execution...

9.3CVSS7.7AI score0.93307EPSS
SaveExploits48References1
VulnCheck KEV
VulnCheck KEV
•added 2017/03/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-0146

The SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution...

9.3CVSS7.5AI score0.89862EPSS
SaveExploits31References1
VulnCheck KEV
VulnCheck KEV
•added 2017/03/14 12:00 a.m.•9 views

VulnCheck KEV: CVE-2017-0022

Microsoft XML Core Services MSXML improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site...

6.5CVSS6.7AI score0.18069EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
•added 2016/11/29 12:00 a.m.•9 views

VulnCheck KEV: CVE-2016-9079

Mozilla Firefox, Firefox ESR, and Thunderbird contain a use-after-free vulnerability in SVG Animation, targeting Firefox and Tor browser users on Windows...

7.5CVSS7.3AI score0.87423EPSS
SaveExploits13References1
Total number of security vulnerabilities5000