Search

Expected end of text, found ':' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (398628 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-50494 1 Amin Omer 1 Wc Sudan Payment Gateway 2024-10-29 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Amin Omer Sudan Payment Gateway for WooCommerce allows Upload a Web Shell to a Web Server.This issue affects Sudan Payment Gateway for WooCommerce: from n/a through 1.2.2.
CVE-2024-50493 1 Masterhomepage 1 Automatic Translation 2024-10-29 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in masterhomepage Automatic Translation allows Upload a Web Shell to a Web Server.This issue affects Automatic Translation: from n/a through 1.0.4.
CVE-2024-50484 1 Mahlamusa 1 Multi Purpose Mail Form 2024-10-29 10 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in mahlamusa Multi Purpose Mail Form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through 1.0.2.
CVE-2022-3857 2024-10-29 5.5 Medium
Maintainer contacted. This is a false-positive. The flaw does not actually exist and was erroneously tested.
CVE-2024-41618 1 Moneymanagerex 1 Money Manager Ex Webapp 2024-10-29 9.8 Critical
Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. The vulnerability is due to improper sanitization of user input in the `TrDeleteArr` parameter, which is directly incorporated into an SQL query.
CVE-2024-41617 1 Moneymanagerex 1 Money Manager Ex Webapp 2024-10-29 9.8 Critical
Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. The `redirect_if_not_loggedin` function in `functions_security.php` fails to terminate script execution after redirecting unauthenticated users. This flaw allows an unauthenticated attacker to upload arbitrary files, potentially leading to Remote Code Execution.
CVE-2024-50575 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 reflected XSS was possible in Widget API
CVE-2024-10073 1 Informatik.hu-berlin 1 Flair 2024-10-29 5 Medium
A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-50576 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via vendor URL in App manifest
CVE-2024-50577 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via Angular template injection in Hub settings
CVE-2024-50578 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible via sprint value on agile boards page
CVE-2024-50579 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 reflected XSS due to insecure link sanitization was possible
CVE-2024-50580 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 multiple XSS were possible due to insecure markdown parsing and custom rendering rule
CVE-2024-50581 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 improper HTML sanitization could lead to XSS attack via comment tag
CVE-2024-50582 1 Jetbrains 1 Youtrack 2024-10-29 4.6 Medium
In JetBrains YouTrack before 2024.3.47707 stored XSS was possible due to improper HTML sanitization in markdown elements
CVE-2024-50574 1 Jetbrains 1 Youtrack 2024-10-29 5.3 Medium
In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk functionality
CVE-2024-50573 1 Jetbrains 1 Hub 2024-10-29 4.3 Medium
In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services
CVE-2024-10014 1 Tiandiyoyo 1 Flat Ui Button 2024-10-29 6.4 Medium
The Flat UI Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's flatbtn shortcode in version 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-44667 1 Shenzhen Haichangxing Technology 1 Hcx H822 Firmware 2024-10-29 8 High
Shenzhen Haichangxing Technology Co., Ltd HCX H822 4G LTE Router M7628NNxISPxUIv2_v1.0.1557.15.35_P0 is vulnerable to Incorrect Access Control. Unauthenticated factory mode reset and command injection leads to information exposure and root shell access.
CVE-2024-47068 3 Redhat, Rollup, Rollupjs 4 Openshift Distributed Tracing, Rhdh, Rollup and 1 more 2024-10-29 6.1 Medium
Rollup is a module bundler for JavaScript. Versions prior to 2.79.2, 3.29.5, and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`/`umd`/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 2.79.2, 3.29.5, and 4.22.4 contain a patch for the vulnerability.