Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (45735 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-38713 1 Imgurl Project 1 Imgurl 2024-11-21 5.4 Medium
imgURL 2.31 allows XSS via an X-Forwarded-For HTTP header.
CVE-2021-38710 1 Yclas 1 Yclas 2024-11-21 6.1 Medium
Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITE_NAME parameter.
CVE-2021-38709 1 Compo 1 Composr Cms 2024-11-21 6.1 Medium
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staff_messaging messaging system for XSS.
CVE-2021-38708 1 Compo 1 Composr Cms 2024-11-21 5.4 Medium
In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS.
CVE-2021-38707 1 Cliniccases 1 Cliniccases 2024-11-21 5.4 Medium
Persistent cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow low-privileged attackers to introduce arbitrary JavaScript to account parameters. The XSS payloads will execute in the browser of any user who views the relevant content. This can result in account takeover via session token theft.
CVE-2021-38704 1 Cliniccases 1 Cliniccases 2024-11-21 6.1 Medium
Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft.
CVE-2021-38702 1 Cyberoamworks 2 Netgenie C0101b1-20141120-ng11vo, Netgenie C0101b1-20141120-ng11vo Firmware 2024-11-21 6.1 Medium
Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=[XSS] attacks.
CVE-2021-38701 1 Motorola 20 T008, T008 Firmware, T100 and 17 more 2024-11-21 4.8 Medium
Certain Motorola Solutions Avigilon devices allow XSS in the administrative UI. This affects T200/201 before 4.10.0.68; T290 before 4.4.0.80; T008 before 2.2.0.86; T205 before 4.12.0.62; T204 before 3.28.0.166; and T100, T101, T102, and T103 before 2.6.0.180.
CVE-2021-38699 1 Tastyigniter 1 Tastyigniter 2024-11-21 5.4 Medium
TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.
CVE-2021-38695 1 Softvibe 1 Saraban 2024-11-21 5.4 Medium
SoftVibe SARABAN for INFOMA 1.1 is vulnerable to stored cross-site scripting (XSS) that allows users to store scripts in certain fields (e.g. subject, description) of the document form.
CVE-2021-38681 1 Qnap 2 Nas, Ragic Cloud Db 2024-11-21 5.3 Medium
A reflected cross-site scripting (XSS) vulnerability has been reported to affect QNAP NAS running Ragic Cloud DB. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already disabled and removed Ragic Cloud DB from the QNAP App Center, pending a security patch from Ragic.
CVE-2021-38680 1 Qnap 1 Kazoo Server 2024-11-21 5.3 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later
CVE-2021-38677 1 Qnap 1 Qcalagent 2024-11-21 5.3 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running QcalAgent. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QcalAgent: QcalAgent 1.1.7 and later
CVE-2021-38675 1 Qnap 2 Image2pdf, Nas 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Image2PDF: Image2PDF 2.1.5 ( 2021/08/17 ) and later
CVE-2021-38674 1 Qnap 3 Qts, Quts Hero, Qutscloud 2024-11-21 4.2 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect QTS, QuTS hero and QuTScloud. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of QTS, QuTS hero and QuTScloud: QuTS hero h4.5.4.1771 build 20210825 and later QTS 4.5.4.1787 build 20210910 and later QuTScloud c4.5.7.1864 and later
CVE-2021-38619 1 Openbaraza 1 Openbaraza Human Capital Management 2024-11-21 6.1 Medium
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input: an unauthenticated remote attacker can conduct a stored cross-site scripting (XSS) attack against an administrative user from hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view=).
CVE-2021-38607 1 Crocoblock 1 Jetengine 2024-11-21 5.4 Medium
Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.
CVE-2021-38603 1 Pluxml 1 Pluxml 2024-11-21 4.8 Medium
PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.
CVE-2021-38602 1 Pluxml 1 Pluxml 2024-11-21 4.8 Medium
PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.
CVE-2021-38583 1 Openbaraza 1 Openbaraza Human Capital Management 2024-11-21 6.1 Medium
openBaraza HCM 3.1.6 does not properly neutralize user-controllable input, which allows reflected cross-site scripting (XSS) on multiple pages: hr/subscription.jsp and hr/application.jsp and and hr/index.jsp (with view= and data=).