Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (336914 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-28020 1 Totolink 2 A800r, A800r Firmware 2025-05-06 7.3 High
TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2025-28021 1 Totolink 2 A810r, A810r Firmware 2025-05-06 7.3 High
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in the downloadFile.cgi through the v14 and v3 parameters
CVE-2025-28022 1 Totolink 2 A810r, A810r Firmware 2025-05-06 7.3 High
TOTOLINK A810R V4.1.2cu.5182_B20201026 was found to contain a buffer overflow vulnerability in downloadFile.cgi through the v25 parameter.
CVE-2024-51243 1 Eladmin 1 Eladmin 2025-05-06 7.2 High
The eladmin v2.7 and before contains a remote code execution (RCE) vulnerability that can control all application deployment servers of this management system via DeployController.java.
CVE-2024-51060 2 Online Admission System Project, Projectworlds 2 Online Admission System, Online Admission System 2025-05-06 9.1 Critical
Projectworlds Online Admission System v1 is vulnerable to SQL Injection in index.php via the 'a_id' parameter.
CVE-2022-40296 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9.8 Critical
The application was vulnerable to a Server-Side Request Forgery attacks, allowing the backend server to interact with unexpected endpoints, potentially including internal and local services, leading to attacks in other downstream systems.
CVE-2022-40293 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9.8 Critical
The application was vulnerable to a session fixation that could be used hijack accounts.
CVE-2022-40292 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 5.3 Medium
The application allowed for Unauthenticated User Enumeration by interacting with an unsecured endpoint to retrieve information on each account within the system.
CVE-2022-40291 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 8.8 High
The application was vulnerable to Cross-Site Request Forgery (CSRF) attacks, allowing an attacker to coerce users into sending malicious requests to the site to delete their account, or in rare circumstances, hijack their account and create other admin accounts.
CVE-2022-40290 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 6.1 Medium
The application was vulnerable to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in the barcode generation functionality, allowing attackers to generate an unsafe link that could compromise users.
CVE-2022-40289 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9 Critical
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the upload and download functionality, which could be leveraged to escalate privileges or compromise any accounts they can coerce into observing the targeted files.
CVE-2022-40288 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9 Critical
The application was vulnerable to an authenticated Stored Cross-Site Scripting (XSS) in the user profile data fields, which could be leveraged to escalate privileges within and compromise any account that views their user profile.
CVE-2022-40287 1 Phppointofsale 1 Php Point Of Sale 2025-05-06 9 Critical
The application was found to be vulnerable to an authenticated Stored Cross-Site Scripting (XSS) vulnerability in messaging functionality, leading to privilege escalation or a compromise of a targeted account.
CVE-2022-3441 1 Rockcontent 1 Rock Convert 2025-05-06 4.8 Medium
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-3440 1 Rockcontent 1 Rock Convert 2025-05-06 6.1 Medium
The Rock Convert WordPress plugin before 2.11.0 does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting
CVE-2022-32927 1 Apple 2 Ipados, Iphone Os 2025-05-06 7.5 High
The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, iOS 16.1 and iPadOS 16. Joining a malicious Wi-Fi network may result in a denial-of-service of the Settings app.
CVE-2022-32926 1 Apple 5 Ipados, Iphone Os, Macos and 2 more 2025-05-06 6.7 Medium
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPadOS 15.7.1, macOS Ventura 13, watchOS 9.1, iOS 16.1 and iPadOS 16. An app with root privileges may be able to execute arbitrary code with kernel privileges.
CVE-2022-32925 1 Apple 3 Iphone Os, Tvos, Watchos 2025-05-06 7.1 High
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 16, iOS 16, watchOS 9. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2022-32922 1 Apple 4 Ipados, Iphone Os, Macos and 1 more 2025-05-06 8.8 High
A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.1, iOS 16.1 and iPadOS 16, macOS Ventura 13. Processing maliciously crafted web content may lead to arbitrary code execution.
CVE-2022-32918 1 Apple 2 Iphone Os, Macos 2025-05-06 5.5 Medium
This issue was addressed with improved data protection. This issue is fixed in iOS 16, macOS Ventura 13. An app may be able to bypass Privacy preferences.