Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (46090 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-30789 1 Monicahq 1 Monica 2025-02-03 5.4 Medium
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/work` endpoint and job and company parameter.
CVE-2023-30838 1 Prestashop 1 Prestashop 2025-02-03 8.6 High
PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, the `ValidateCore::isCleanHTML()` method of Prestashop misses hijackable events which can lead to cross-site scripting (XSS) injection, allowed by the presence of pre-setup `@keyframes` methods. This XSS, which hijacks HTML attributes, can be triggered without any interaction by the visitor/administrator, which makes it as dangerous as a trivial XSS attack. Contrary to other attacks which target HTML attributes and are triggered without user interaction (such as onload / onerror which suffer from a very limited scope), this one can hijack every HTML element, which increases the danger due to a complete HTML elements scope. Versions 8.0.4 and 1.7.8.9 contain a fix for this issue.
CVE-2023-30787 1 Monicahq 1 Monica 2025-02-03 5.4 Medium
MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/introductions` endpoint and first_met_additional_info parameter.
CVE-2023-30212 1 Ourphp 1 Ourphp 2025-02-03 6.1 Medium
OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
CVE-2023-30210 1 Ourphp 1 Ourphp 2025-02-03 6.1 Medium
OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
CVE-2023-25346 1 Churchcrm 1 Churchcrm 2025-02-03 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the id parameter of /churchcrm/v2/family/not-found.
CVE-2022-25276 1 Drupal 1 Drupal 2025-02-03 6.1 Medium
The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.
CVE-2023-30417 1 Pearadmin 1 Pear Admin Boot 2025-02-03 5.4 Medium
A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message.
CVE-2023-30267 1 Cltphp 1 Cltphp 2025-02-03 6.1 Medium
CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
CVE-2023-30177 1 Craftcms 1 Craft Cms 2025-02-03 6.1 Medium
CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
CVE-2023-30111 1 Medicine Tracker System Project 1 Medicine Tracker System 2025-02-03 6.1 Medium
Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
CVE-2023-30106 1 Medicine Tracker System Project 1 Medicine Tracker System 2025-02-03 6.1 Medium
Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.
CVE-2023-2291 1 Zohocorp 3 Manageengine Access Manager Plus, Manageengine Pam360, Manageengine Password Manager Pro 2025-02-03 7.8 High
Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager Pro, and ManageEngine PAM360. These credentials could allow a malicious actor to modify configuration data that would escalate their permissions from that of a low-privileged user to an Administrative user.
CVE-2023-29836 1 Exelysis 1 Exelysis Unified Communications Solution 2025-02-03 6.1 Medium
Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitrary code via the Username parameter of the eucsAdmin login form.
CVE-2023-29442 1 Zohocorp 1 Manageengine Applications Manager 2025-02-03 6.1 Medium
Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
CVE-2022-39989 1 Fighting Cock Information System Project 1 Fighting Cock Information System 2025-02-03 9.8 Critical
An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the credentials.
CVE-2022-27979 1 Tooljet 1 Tooljet 2025-02-03 5.4 Medium
A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Comment Body component.
CVE-2024-38681 1 Wpthemespace 1 Magical Addons For Elementor 2025-02-03 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Noor alam Magical Addons For Elementor allows Stored XSS.This issue affects Magical Addons For Elementor: from n/a through 1.1.41.
CVE-2024-38711 1 Ylefebvre 1 Link Library 2025-02-03 7.1 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.7.1.
CVE-2024-37947 1 Themeum 1 Tutor Lms 2025-02-03 5.9 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themeum Tutor LMS allows Stored XSS.This issue affects Tutor LMS: from n/a through 2.7.2.