Lucene search
+L
Vulncheck KevMost viewed

5118 matches found

VulnCheck KEV
VulnCheck KEV
added 2025/03/19 12:00 a.m.7 views

VulnCheck KEV: CVE-2022-0074

Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This affects versions from 1.6.15 before 1.7.16.1...

8.8CVSS5.8AI score0.01166EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/19 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-3809

The Porto Theme - Functionality plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.9 via the 'slideshowtype' post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute...

8.8CVSS5.8AI score0.01002EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/12 12:00 a.m.7 views

VulnCheck KEV: CVE-2017-0176

A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol...

9.3CVSS7.9AI score0.45775EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/11 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-24984

Microsoft Windows New Technology File System NTFS contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read...

4.6CVSS5.7AI score0.01956EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/11 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-26633

Microsoft Windows Management Console MMC contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally...

7CVSS7.2AI score0.30391EPSS
SaveExploits7References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/10 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-13161

Ivanti Endpoint Manager EPM contains an absolute path traversal vulnerability that allows a remote unauthenticated attacker to leak sensitive information...

9.8CVSS5.8AI score0.90081EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/07 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-1316

Edimax IC-7100 IP camera contains an OS command injection vulnerability due to improper input sanitization that allows an attacker to achieve remote code execution via specially crafted requests. The impacted product could be end-of-life EoL and/or end-of-service EoS. Users should discontinue...

9.8CVSS7.8AI score0.73236EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/07 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-1315

The InWave Jobs plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 3.5.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers...

9.8CVSS5.8AI score0.00484EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/04 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-22226

VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. Successful exploitation allows an attacker with administrative privileges to a virtual machine to leak memory from the vmx process...

7.1CVSS7.3AI score0.01735EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/03/03 12:00 a.m.7 views

VulnCheck KEV: CVE-2022-43769

Hitachi Vantara Pentaho BA Server contains a special element injection vulnerability that allows an attacker to inject Spring templates into properties files, allowing for arbitrary command execution...

8.8CVSS7.4AI score0.9767EPSS
SaveExploits6References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/27 12:00 a.m.7 views

VulnCheck KEV: CVE-1999-0526

An X server's access control is disabled e.g. through an "xhost +" command and allows anyone to connect to the server...

10CVSS5.8AI score0.20817EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/27 12:00 a.m.7 views

VulnCheck KEV: CVE-2021-23263

Unauthenticated remote attackers can read textual content via FreeMarker including files /scripts/, /templates/ and some of the files in /.git/ non-binary...

7.5CVSS5.8AI score0.01581EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/27 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-26987

In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix deadlock when hugetlboptimizevmemmap is enabled When I did hard offline test with hugetlb pages, below deadlock occurs: ====================================================== WARNING: possible circular...

5.5CVSS5.7AI score0.00175EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/26 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-38100

Windows File Explorer Elevation of Privilege Vulnerability...

7.8CVSS7.3AI score0.04515EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/25 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-23108

An improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests...

10CVSS7.4AI score0.78375EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/24 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-20953

Oracle Agile Product Lifecycle Management PLM contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system...

8.8CVSS7.3AI score0.03934EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/19 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-24989

Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control...

9.8CVSS7.3AI score0.01722EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/12 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-2353

A vulnerability, which was classified as critical, has been found in Totolink X6000R 9.4.0cu.85220230719. This issue affects the function setDiagnosisCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation of the argument ip leads to os command injection. The attack may be...

9CVSS5.5AI score0.03952EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/11 12:00 a.m.7 views

VulnCheck KEV: CVE-2018-1217

Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or change the Local...

9.8CVSS5.8AI score0.45957EPSS
SaveExploits5References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/06 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-0994

Trimble Cityworks contains a deserialization vulnerability. This could allow an authenticated user to perform a remote code execution attack against a customer's Microsoft Internet Information Services IIS web server...

8.8CVSS7.8AI score0.31309EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/02/04 12:00 a.m.7 views

VulnCheck KEV: CVE-2018-19410

Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges including administrator...

9.8CVSS5.8AI score0.86579EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/01/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2022-3573

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute...

5.4CVSS7.2AI score0.00585EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2025/01/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2022-44149

The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required...

8.8CVSS7.5AI score0.64354EPSS
SaveExploits5References1
VulnCheck KEV
VulnCheck KEV
added 2025/01/14 12:00 a.m.7 views

VulnCheck KEV: CVE-2025-21333

Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges...

7.8CVSS6AI score0.09988EPSS
SaveExploits6References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/20 12:00 a.m.7 views

VulnCheck KEV: CVE-2021-42912

FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker, once logged in, to send commands to the operating system as the root user via the ping diagnostic tool, bypassing the IP address field, and concatenating OS commands...

9CVSS5.8AI score0.10006EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/12 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-38653

XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server...

8.2CVSS5.9AI score0.91984EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/10 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-35286

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

9.8CVSS7.4AI score0.65367EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/10 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-55956

Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or PowerShell commands on the host system by leveraging the default settings of the...

9.8CVSS7.5AI score0.93804EPSS
SaveExploits4References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/06 12:00 a.m.7 views

VulnCheck KEV: CVE-2023-31248

Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; nftchainlookupbyid failed to check whether a chain was active and CAPNETADMIN is in any user or network namespace...

7.8CVSS6.7AI score0.0205EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/05 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-52276

User Interface UI Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer flattened version, which is provided when the "Print" option is used. 2. Displayed version does not show the layer flattened version, which...

8.2CVSS5.8AI score0.00353EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/05 12:00 a.m.7 views

VulnCheck KEV: CVE-2023-38192

An issue was discovered in SuperWebMailer 9.00.0.01710. It allows superadmincreate.php XSS via crafted incorrect passwords...

6.1CVSS5.8AI score0.01116EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/05 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-51211

SQL injection vulnerability exists in OS4ED openSIS-Classic Version 9.1, specifically in the resetuserinfo.php file. The vulnerability is due to improper input validation of the $usernamestnid parameter, which can be manipulated by an attacker to inject arbitrary SQL commands...

9.8CVSS6AI score0.02256EPSS
SaveExploits2References1
VulnCheck KEV
VulnCheck KEV
added 2024/12/05 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-52270

User Interface UI Misrepresentation of Critical Information vulnerability in DropBox SignHelloSign allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed e.g. via Google Chrome - Examine the print preview: Will render the...

8.2CVSS5.8AI score0.00191EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/11/26 12:00 a.m.7 views

VulnCheck KEV: CVE-2021-41295

ECOA BAS controller has a Cross-Site Request Forgery vulnerability, thus authenticated attacker can remotely place a forged request at a malicious web page and execute CRUD commands GET, POST, PUT, DELETE to perform arbitrary operations in the system...

8.8CVSS6AI score0.00429EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/11/26 12:00 a.m.7 views

VulnCheck KEV: CVE-2019-10647

ZZZCMS zzzphp v1.6.3 allows remote attackers to execute arbitrary PHP code via a .php URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter because of a lack of inc/zzzfile.php restrictions. For example, source%5B%5D=http%3A%2F%2F192.168.0.1%2Ftest.php can be used if...

9.8CVSS6.1AI score0.06643EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/11/20 12:00 a.m.7 views

VulnCheck KEV: CVE-2023-28711

Insufficient control flow management in the Hyperscan Library maintained by IntelR before version 5.4.1 may allow an authenticated user to potentially enable denial of service via local access...

5.5CVSS5.8AI score0.00171EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/11/07 12:00 a.m.7 views

VulnCheck KEV: CVE-2014-2120

Cisco Adaptive Security Appliance ASA contains a cross-site scripting XSS vulnerability in the WebVPN login page. This vulnerability allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter...

6.1CVSS7.3AI score0.18919EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/11/01 12:00 a.m.7 views

VulnCheck KEV: CVE-2023-28769

The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.17ABYO.1C0 could allow a remote unauthenticated attacker to execute some OS commands or to cause denial-of-service DoS conditions on a vulnerable device...

9.8CVSS7.7AI score0.0542EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/31 12:00 a.m.7 views

VulnCheck KEV: CVE-2020-29574

CyberoamOS CROS contains a SQL injection vulnerability in the WebAdmin that allows an unauthenticated attacker to execute arbitrary SQL statements remotely...

9.8CVSS7.6AI score0.04729EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/30 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-21894

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution...

9.8CVSS5.8AI score0.18987EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/22 12:00 a.m.7 views

VulnCheck KEV: CVE-2020-11900

The Treck TCP/IP stack before 6.0.1.41 has an IPv4 tunneling Double Free...

8.2CVSS7.3AI score0.13195EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/21 12:00 a.m.7 views

VulnCheck KEV: CVE-2023-20263

A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could...

6.1CVSS7.3AI score0.00484EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2016-15041

The MainWP Dashboard -The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mwpsetuppurchaseusername' parameter in versions up to, and including, 3.1.2 due to insufficient input sanitization and output...

7.2CVSS5.8AI score0.01261EPSS
SaveExploits3References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2024-45409

The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in = 12.2 and 1.13.0 = 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document by the IdP can thus forge a SAML...

10CVSS7.3AI score0.10684EPSS
SaveExploits3References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2020-36836

The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized arbitrary file deletion in versions up to, and including, 0.9.0.2 due to a lack of capability checking and insufficient path validation. This makes it possible for authenticated users with minimal permissions to delete...

8.1CVSS5.9AI score0.01407EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2021-4445

The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the padismissadminnotice AJAX action. This makes it possible for authenticated subscriber+ attackers to...

6.5CVSS5.8AI score0.00395EPSS
SaveExploits1References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2023-7290

The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the checkforverifiedprofiles function in versions up to, and including, 4.3.7. This makes it possible for authenticated attackers with...

4.3CVSS5.8AI score0.00249EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2019-25214

The ShopWP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several REST API routes in versions up to, and including, 2.0.4. This makes it possible for unauthenticated attackers to call the endpoints and perform unauthorized actions such as...

7.2CVSS5.8AI score0.00334EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2020-36837

The ThemeGrill Demo Importer plugin for WordPress is vulnerable to authentication bypass due to a missing capability check on the resetwizardactions function in versions 1.3.4 through 1.6.1. This makes it possible for authenticated attackers to reset the WordPress database. After which, if...

9.9CVSS5.8AI score0.00584EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2024/10/15 12:00 a.m.7 views

VulnCheck KEV: CVE-2016-15040

The Kento Post View Counter plugin for WordPress is vulnerable to SQL Injection via the 'kentopvcgeo' parameter in versions up to, and including, 2.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

9.8CVSS5.9AI score0.00545EPSS
SaveExploits0References1
Total number of security vulnerabilities5000