Export limit exceeded: 337616 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 337616 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (337616 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-1269 | 1 Remyandrade | 1 Product Management System | 2025-06-10 | 2.4 Low |
| A vulnerability has been found in SourceCodester Product Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /supplier.php. The manipulation of the argument supplier_name/supplier_contact leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-253012. | ||||
| CVE-2024-0497 | 1 Campcodes | 1 Simple Student Information System | 2025-06-10 | 6.3 Medium |
| A vulnerability was found in Campcodes Student Information System 1.0. It has been classified as critical. Affected is an unknown function of the file /classes/Users.php?f=save. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-250602 is the identifier assigned to this vulnerability. | ||||
| CVE-2024-1253 | 1 Byzoro | 2 Smart S40, Smart S40 Firmware | 2025-06-10 | 4.7 Medium |
| A vulnerability, which was classified as critical, has been found in Byzoro Smart S40 Management Platform up to 20240126. Affected by this issue is some unknown functionality of the file /useratte/web.php of the component Import Handler. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-252992. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2024-5198 | 1 Openvpn | 1 Ovpn-dco-win | 2025-06-10 | 3.3 Low |
| OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivileged local attacker to send I/O control messages with invalid data to the driver resulting in a NULL pointer dereference leading to a system halt. | ||||
| CVE-2024-4090 | 1 Premio | 1 My Sticky Bar | 2025-06-10 | 4.8 Medium |
| The Floating Notification Bar, Sticky Menu on Scroll, Announcement Banner, and Sticky Header for Any WordPress plugin before 2.7.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | ||||
| CVE-2024-21643 | 1 Microsoft | 1 Identitymodel Extensions | 2025-06-10 | 7.1 High |
| IdentityModel Extensions for .NET provide assemblies for web developers that wish to use federated identity providers for establishing the caller's identity. Anyone leveraging the `SignedHttpRequest`protocol or the `SignedHttpRequestValidator`is vulnerable. Microsoft.IdentityModel trusts the `jku`claim by default for the `SignedHttpRequest`protocol. This raises the possibility to make any remote or local `HTTP GET` request. The vulnerability has been fixed in Microsoft.IdentityModel.Protocols.SignedHttpRequest. Users should update all their Microsoft.IdentityModel versions to 7.1.2 (for 7x) or higher, 6.34.0 (for 6x) or higher. | ||||
| CVE-2024-26503 | 2 Gunet, Openeclass | 2 Open Eclass Platform, Openeclass | 2025-06-10 | 9.1 Critical |
| Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code via upload of crafted file to certbadge.php endpoint. | ||||
| CVE-2024-26540 | 1 Cimg | 1 Cimg | 2025-06-10 | 7.8 High |
| A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze. | ||||
| CVE-2023-50308 | 3 Ibm, Linux, Microsoft | 5 Aix, Db2, Linux On Ibm Z and 2 more | 2025-06-10 | 6.5 Medium |
| IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is run on columnar tables. IBM X-Force ID: 273393. | ||||
| CVE-2024-6272 | 2 10web, Spidercontacts | 2 Spidercontacts, Spidercontacts Wordpress | 2025-06-10 | 6.1 Medium |
| The SpiderContacts WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||||
| CVE-2024-6536 | 2 Dylanjames, Dylanjkotze | 2 Zephyr Project Manager, Zephyr Project Manager | 2025-06-10 | 5.4 Medium |
| The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-4217 | 1 Getshortcodes | 1 Shortcodes Ultimate | 2025-06-10 | 4.7 Medium |
| The shortcodes-ultimate-pro WordPress plugin before 7.1.5 does not properly escape some of its shortcodes' settings, making it possible for attackers with a Contributor account to conduct Stored XSS attacks. | ||||
| CVE-2024-22259 | 3 Netapp, Redhat, Vmware | 3 Active Iq Unified Manager, Amq Broker, Spring Framework | 2025-06-10 | 8.1 High |
| Applications that use UriComponentsBuilder in Spring Framework to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. This is the same as CVE-2024-22243 https://spring.io/security/cve-2024-22243 , but with different input. | ||||
| CVE-2024-0974 | 1 Bmwebproperties | 1 Social Media Widget | 2025-06-10 | 4.8 Medium |
| The Social Media Widget WordPress plugin before 4.0.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-28283 | 1 Linksys | 2 E1000, E1000 Firmware | 2025-06-10 | 6.7 Medium |
| There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, leading to remote code execution. | ||||
| CVE-2021-25254 | 1 Yandex | 1 Yandex Browser | 2025-06-10 | 5.3 Medium |
| Yandex Browser Lite for Android before 21.1.0 allows remote attackers to spoof the address bar. | ||||
| CVE-2024-24110 | 1 Crmeb | 1 Crmeb Java | 2025-06-10 | 6.5 Medium |
| SQL Injection vulnerability in crmeb_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the component /api/front/spread/people. | ||||
| CVE-2021-25255 | 1 Yandex | 1 Yandex Browser | 2025-06-10 | 7.5 High |
| Yandex Browser Lite for Android prior to version 21.1.0 allows remote attackers to cause a denial of service. | ||||
| CVE-2021-25262 | 2 Google, Yandex | 2 Android, Yandex Browser | 2025-06-10 | 5.4 Medium |
| Yandex Browser for Android prior to version 21.3.0 allows remote attackers to perform IDN homograph attack. | ||||
| CVE-2025-5721 | 1 Razormist | 1 Student Result Management System | 2025-06-10 | 2.4 Low |
| A vulnerability, which was classified as problematic, was found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /script/academic/core/update_profile of the component Profile Setting Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||