Search

Expected end of text, found ':' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (362832 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-20437 1 Cisco 1 Ios Xe 2024-10-24 8.1 High
A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a cross-site request forgery (CSRF) attack and execute commands on the CLI of an affected device. This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading an already authenticated user to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the targeted user.
CVE-2024-50050 1 Meta Platforms Inc 1 Llama Stack 2024-10-24 6.3 Medium
Llama Stack prior to revision 7a8aa775e5a267cf8660d83140011a0b7f91e005 used pickle as a serialization format for socket communication, potentially allowing for remote code execution. Socket communication has been changed to use JSON instead.
CVE-2024-46937 1 Mfasoft 1 Secure Authentication Server 2024-10-24 9.1 Critical
An improper access control (IDOR) vulnerability in the /api-selfportal/get-info-token-properties endpoint in MFASOFT Secure Authentication Server (SAS) 1.8.x through 1.9.x before 1.9.040924 allows remote attackers gain access to user tokens without authentication. The is a brute-force attack on the serial parameter by number identifier: GA00001, GA00002, GA00003, etc.
CVE-2024-49324 1 Sovratec 2 Case Management, Sovratec Case Management 2024-10-24 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Sovratec Sovratec Case Management allows Upload a Web Shell to a Web Server.This issue affects Sovratec Case Management: from n/a through 1.0.0.
CVE-2024-49331 2 Myriad Solutionz, Myriadsolutionz 2 Property Lot Management System, Property Lot Management System 2024-10-24 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Myriad Solutionz Property Lot Management System allows Upload a Web Shell to a Web Server.This issue affects Property Lot Management System: from n/a through 4.2.38.
CVE-2024-49332 2 Giveaway Boost, Giveawayboost 2 Giveaway Boost, Giveaway Boost 2024-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in Giveaway Boost allows Object Injection.This issue affects Giveaway Boost: from n/a through 2.1.4.
CVE-2024-49605 1 Avchat.net 1 Avchat Video Chat 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Avchat.Net AVChat Video Chat allows Stored XSS.This issue affects AVChat Video Chat: from n/a through 2.2.
CVE-2024-49335 1 Edush Maxim 1 Googledrive Folder List 2024-10-24 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Edush Maxim GoogleDrive folder list allows Stored XSS.This issue affects GoogleDrive folder list: from n/a through 2.2.2.
CVE-2024-48657 2 Itsourcecode, Princelycesar 2 Hospital Management System, Hospital Management System 2024-10-24 8.1 High
SQL Injection vulnerability in hospital management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.
CVE-2024-48656 2 Angeljudesuarez, Itsourcecode 2 Student Management System, Student Management System 2024-10-24 5.4 Medium
Cross Site Scripting vulnerability in student management system in php with source code v.1.0.0 allows a remote attacker to execute arbitrary code.
CVE-2024-49624 1 Smartdevth 1 Advanced Advertising System 2024-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in Smartdevth Advanced Advertising System allows Object Injection.This issue affects Advanced Advertising System: from n/a through 1.3.1.
CVE-2024-10195 1 Tecno-mobile 2 4g Portable Wifi Tr118, 4g Portable Wifi Tr118 Firmware 2024-10-24 4.7 Medium
A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goform_get_cmd_process of the component SMS Check. The manipulation of the argument order_by leads to sql injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-49631 1 Mdabdulkader 1 Easy Addons For Elementor 2024-10-24 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Md Abdul Kader Easy Addons for Elementor allows Stored XSS.This issue affects Easy Addons for Elementor: from n/a through 1.3.0.
CVE-2024-10200 1 Wellchoose 1 Administrative Management System 2024-10-24 7.5 High
Administrative Management System from Wellchoose has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to download arbitrary files on the server.
CVE-2024-10201 1 Wellchoose 1 Administrative Management System 2024-10-24 8.8 High
Administrative Management System from Wellchoose does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload and execute webshells.
CVE-2024-8625 2 Pollbytotalsoft, Total-soft 2 Ts Poll, Ts Poll 2024-10-24 7.2 High
The TS Poll WordPress plugin before 2.4.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks
CVE-2024-43945 1 Latepoint 1 Latepoint 2024-10-24 6.5 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.
CVE-2024-9923 1 Teamplus 1 Team\+ Pro 2024-10-24 4.9 Medium
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing remote attackers with administrator privileges to move arbitrary system files to the website root directory and access them.
CVE-2024-9922 1 Teamplus 2 Team\+, Team\+ Pro 2024-10-24 7.5 High
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate a specific page parameter, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files.
CVE-2024-9921 1 Teamplus 2 Team\+, Team\+ Pro 2024-10-24 9.8 Critical
The Team+ from TEAMPLUS TECHNOLOGY does not properly validate specific page parameter, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify and delete database contents.