Export limit exceeded: 342739 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 342739 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (342739 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-5596 | 1 Griptape-ai | 1 Griptape | 2026-04-06 | 6.3 Medium |
| A vulnerability was detected in griptape-ai griptape 0.19.4. Affected by this issue is some unknown functionality of the file griptape/tools/sql/tool.py of the component SqlTool. Performing a manipulation results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2019-25656 | 1 R-project | 1 R | 2026-04-06 | 8.4 High |
| R i386 3.5.0 contains a local buffer overflow vulnerability in the GUI Preferences dialog that allows local attackers to trigger a structured exception handler (SEH) overwrite by supplying malicious input. Attackers can craft a payload string in the 'Language for menus and messages' field to overwrite SEH records and achieve code execution with calculator or arbitrary shellcode. | ||||
| CVE-2019-25657 | 1 Anyburn | 1 Anyburn X86 | 2026-04-06 | 5.5 Medium |
| AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the image conversion function. Attackers can paste a large buffer into the source or destination image file fields and click Convert Now to trigger a crash. | ||||
| CVE-2019-25658 | 1 Amac | 1 Mac Address Change | 2026-04-06 | 5.5 Medium |
| a-Mac Address Change 5.4 contains a local buffer overflow vulnerability that allows local attackers to crash the application by supplying oversized input to registration form fields. Attackers can paste 212 bytes of data into the 'Your Name', 'Your Company', or 'Register Code' fields and click the Register button to trigger a denial of service crash. | ||||
| CVE-2019-25659 | 1 Xlinesoft | 1 Asprunner Professional | 2026-04-06 | 6.2 Medium |
| ASPRunner Professional 6.0.766 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an excessively long project name. Attackers can paste 180 or more characters into the Project name field during project creation to trigger an application crash. | ||||
| CVE-2019-25660 | 1 Hainsoft | 1 Lanhelper | 2026-04-06 | 6.2 Medium |
| LanHelper 1.74 contains a local buffer overflow vulnerability that allows attackers to crash the application by sending excessively long input strings. Attackers can exploit the Form Send Message feature by pasting 6000 bytes of data into the Message text field to trigger a denial of service condition. | ||||
| CVE-2019-25661 | 1 Lizardsystems | 1 Remote Process Explorer | 2026-04-06 | 6.2 Medium |
| Remote Process Explorer 1.0.0.16 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by sending a crafted payload to the Add Computer dialog. Attackers can paste a malicious string into the computer name textbox and trigger a crash by connecting to the added computer, overwriting the SEH chain and corrupting exception handlers. | ||||
| CVE-2019-25662 | 1 Montala | 1 Resourcespace | 2026-04-06 | 8.2 High |
| ResourceSpace 8.6 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'ref' parameter. Attackers can send GET requests to the watched_searches.php endpoint with crafted SQL payloads to extract sensitive database information including usernames and credentials. | ||||
| CVE-2019-25663 | 2 Salesagility, Suitecrm | 2 Suitecrm, Suitecrm | 2026-04-06 | 7.1 High |
| SuiteCRM 7.10.7 contains a SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the parentTab parameter. Attackers can send GET requests to the email module with malicious parentTab values using boolean-based SQL injection techniques to extract sensitive database information. | ||||
| CVE-2019-25664 | 2 Salesagility, Suitecrm | 2 Suitecrm, Suitecrm | 2026-04-06 | 7.1 High |
| SuiteCRM 7.10.7 contains a time-based SQL injection vulnerability in the record parameter of the Users module DetailView action that allows authenticated attackers to manipulate database queries. Attackers can append SQL code to the record parameter in GET requests to the index.php endpoint to extract sensitive database information through time-based blind SQL injection techniques. | ||||
| CVE-2019-25665 | 1 Riverpast | 1 River Past Ringtone Converter | 2026-04-06 | 6.2 Medium |
| River Past Ringtone Converter 2.7.6.1601 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying oversized input to activation fields. Attackers can paste 300 bytes of data into the Email textbox and Activation code textarea via the Help menu's Activate dialog to trigger a denial of service condition. | ||||
| CVE-2019-25666 | 2 Nsasoft, Nsauditor | 2 Spotauditor, Spotauditor | 2026-04-06 | 6.2 Medium |
| SpotAuditor 3.6.7 contains a local buffer overflow vulnerability in the Base64 Password Decoder component that allows attackers to crash the application. Attackers can supply an oversized Base64 string through the decoder interface to trigger a denial of service condition. | ||||
| CVE-2019-25667 | 1 Iarsn | 1 Taskinfo | 2026-04-06 | 6.2 Medium |
| TaskInfo 8.2.0.280 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying oversized input to registration fields. Attackers can paste excessively long strings into the New User Name or New Serial Number textboxes in the Help menu's registration dialog to trigger a denial of service condition. | ||||
| CVE-2019-25668 | 2 News Website Script Project, Phpscriptsmall | 2 News Website Script, News Website Script | 2026-04-06 | 8.2 High |
| News Website Script 2.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the news ID parameter. Attackers can send GET requests to index.php/show/news/ with malicious SQL statements to extract sensitive database information. | ||||
| CVE-2019-25669 | 1 Qdpm | 1 Qdpm | 2026-04-06 | 8.2 High |
| qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract database information. | ||||
| CVE-2019-25670 | 1 River Past | 1 River Past Video Cleaner | 2026-04-06 | 8.4 High |
| River Past Video Cleaner 7.6.3 contains a structured exception handler buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious string in the Lame_enc.dll field. Attackers can craft a payload with 280 bytes of padding, a next structured exception handler override, and shellcode to trigger code execution when the application processes the input. | ||||
| CVE-2019-25671 | 1 Va Max | 1 Va Max | 2026-04-06 | 8.8 High |
| VA MAX 8.3.4 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the mtu_eth0 parameter. Attackers can send POST requests to the changeip.php endpoint with malicious payload in the mtu_eth0 field to execute commands as the apache user. | ||||
| CVE-2019-25672 | 2 Kartatopia, Pilus | 2 Piluscart, Piluscart | 2026-04-06 | 8.2 High |
| PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter. Attackers can submit POST requests to the comment submission endpoint with RLIKE-based boolean SQL injection payloads to extract sensitive database information. | ||||
| CVE-2019-25673 | 1 Unisharp | 1 Laravel-filemanager | 2026-04-06 | 8.8 High |
| UniSharp Laravel File Manager v2.0.0-alpha7 and v2.0 contain an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by sending multipart form data to the upload endpoint. Attackers can upload PHP files with the type parameter set to Files and execute arbitrary code by accessing the uploaded file through the working directory path. | ||||
| CVE-2019-25674 | 1 Victoralagwu | 1 Cmssite | 2026-04-06 | 8.2 High |
| CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL injection attacks. | ||||