Search

Expected end of text, found ',' (at char 15), (line:1, col:16)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (345210 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-65132 1 Alandsilva26 1 Hotel-management-php 2026-04-17 6.1 Medium
alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute arbitrary JavaScript via the room_id GET parameter.
CVE-2025-65136 1 Manikandan580 1 School-management-system 2026-04-17 6.1 Medium
In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter.
CVE-2025-65134 1 Manikandan580 1 School-management-system 2026-04-17 N/A
In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.
CVE-2025-70936 1 Vtiger 1 Crm 2026-04-17 5.4 Medium
Vtiger CRM 8.4.0 contains a reflected cross-site scripting (XSS) vulnerability in the MailManager module. Improper handling of user-controlled input in the _folder parameter allows a specially crafted, double URL-encoded payload to be reflected and executed in the context of an authenticated user s session.
CVE-2026-38526 1 Krayin 1 Laravel-crm 2026-04-17 9.9 Critical
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2025-65135 1 Manikandan580 1 School-management-system 2026-04-17 9.8 Critical
In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fromdate POST parameter.
CVE-2025-63939 1 Anirudhkannanvp 1 Grocery Store Management System 2026-04-17 9.8 Critical
Improper input handling in /Grocery/search_products_itname.php, in anirudhkannan Grocery Store Management System 1.0, allows SQL injection via the sitem_name POST parameter.
CVE-2026-37598 1 Sourcecodester 1 Patient Appointment Scheduler System 2026-04-17 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to arbitrary code execution (RCE) via /scheduler/classes/SystemSettings.php?f=update_settings.
CVE-2026-37590 1 Sourcecodester 1 Storage Unit Rental Management System 2026-04-17 2.7 Low
SourceCodester Storage Unit Rental Management System v1.0 is vulnerable to SQL Injection in the file /storage/admin/rents/manage_rent.php.
CVE-2026-37591 1 Sourcecodester 1 Storage Unit Rental Management System 2026-04-17 2.7 Low
Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL injection in the file /storage/admin/tenants/view_details.php.
CVE-2026-37597 1 Sourcecodester 1 Online Employees Work From Home Attendance System 2026-04-17 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.
CVE-2026-37600 1 Sourcecodester 1 Patient Appointment Scheduler System 2026-04-17 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.
CVE-2026-37602 1 Sourcecodester 1 Patient Appointment Scheduler System 2026-04-17 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.
CVE-2026-37596 1 Sourcecodester 1 Online Employees Work From Home Attendance System 2026-04-17 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_department.php.
CVE-2026-37595 1 Sourcecodester 1 Online Employees Work From Home Attendance System 2026-04-17 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/manage_employee.php.
CVE-2026-37592 1 Sourcecodester 1 Storage Unit Rental Management System 2026-04-17 2.7 Low
Sourcecodester Storage Unit Rental Management System v1.0 is vulnerable to SQL in the file /storage/admin/maintenance/manage_pricing.php.
CVE-2026-37593 1 Sourcecodester 1 Online Employees Work From Home Attendance System 2026-04-17 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_att.php.
CVE-2026-37594 1 Sourcecodester 1 Online Employees Work From Home Attendance System 2026-04-17 2.7 Low
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/view_employee.php.
CVE-2026-37601 1 Sourcecodester 1 Patient Appointment Scheduler System 2026-04-17 2.7 Low
SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.
CVE-2026-3146 1 Libvips 1 Libvips 2026-04-17 3.3 Low
A vulnerability has been found in libvips up to 8.18.0. The impacted element is the function vips_foreign_load_matrix_header of the file libvips/foreign/matrixload.c. The manipulation leads to null pointer dereference. The attack needs to be performed locally. The identifier of the patch is d4ce337c76bff1b278d7085c3c4f4725e3aa6ece. To fix this issue, it is recommended to deploy a patch.