Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (48478 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2017-9621 1 Epesi 1 Epesi 2025-04-20 6.1 Medium
Cross-site scripting (XSS) vulnerability in modules/Base/Lang/Administrator/update_translation.php in EPESI in Telaxus/EPESI 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) original or (2) new parameter.
CVE-2017-9613 1 Sap 1 Successfactors 2025-04-20 N/A
Stored Cross-site scripting (XSS) vulnerability in SAP SuccessFactors before b1705.1234962 allows remote authenticated users to inject arbitrary web script or HTML via the file upload functionality.
CVE-2017-9609 1 Blackcat-cms 1 Blackcat Cms 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows remote authenticated users to inject arbitrary web script or HTML via the map_language parameter to backend/pages/lang_settings.php.
CVE-2017-9781 1 Check Mk Project 1 Check Mk 2025-04-20 N/A
A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6, allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py, which is returned unencoded with content type text/html.
CVE-2015-5181 1 Redhat 3 Jboss A-mq, Jboss Amq, Jboss Fuse 2025-04-20 N/A
The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
CVE-2017-1000058 1 Chevereto 1 Chevereto 2025-04-20 N/A
Stored XSS vulnerabilities in chevereto CMS before version 3.8.11, one in the user profile and one in the Exif data parser.
CVE-2017-9556 1 Synology 1 Video Station 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in Video Metadata Editor in Synology Video Station before 2.3.0-1435 allows remote authenticated attackers to inject arbitrary web script or HTML via the title parameter.
CVE-2017-1000043 1 Mapbox 1 Mapbox.js 2025-04-20 6.1 Medium
Mapbox.js versions 1.x prior to 1.6.6 and 2.x prior to 2.2.4 are vulnerable to a cross-site-scripting attack in certain uncommon usage scenarios via TileJSON name and map share control
CVE-2017-9555 1 Synology 1 Photo Station 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.0-3414 allows remote attackers to inject arbitrary web script or HTML via the image parameter.
CVE-2017-9548 1 Bigtreecms 1 Bigtree Cms 2025-04-20 N/A
admin.php in BigTree through 4.2.18 has a Cross-site Scripting (XSS) vulnerability, which allows remote authenticated users to inject arbitrary web script or HTML by launching a Home Template Edit Page action and entering the Navigation Title of a page that is scheduled for future publication (aka a pending page change).
CVE-2017-9546 1 Bigtreecms 1 Bigtree Cms 2025-04-20 N/A
admin.php in BigTree through 4.2.18 allows remote authenticated users to cause a denial of service (inability to save revisions) via XSS sequences in a revision name.
CVE-2017-9252 1 Finecms Project 1 Finecms 2025-04-20 N/A
andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action.
CVE-2017-1000035 1 Tt-rss 1 Tiny Tiny Rss 2025-04-20 N/A
Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack
CVE-2017-9249 1 Allen Disk Project 1 Allen Disk 2025-04-20 5.4 Medium
Cross-site scripting (XSS) vulnerability in Allen Disk 1.6 allows remote authenticated users to inject arbitrary web script or HTML persistently by uploading a crafted HTML file. The attack vector is the content of this file, and the filename must be specified in the PATH_INFO to readfile.php.
CVE-2017-9244 1 Trello 1 Trello 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in the Trello app before 4.0.8 for iOS might allow remote attackers to inject arbitrary web script or HTML by uploading and attaching a crafted photo to a Card.
CVE-2017-9243 1 Aries Networks 2 Qwr-1104 Wireless-n Router, Qwr-1104 Wireless-n Router Firmware 2025-04-20 N/A
Aries QWR-1104 Wireless-N Router with Firmware Version WRC.253.2.0913 has XSS on the Wireless Site Survey page, exploitable with the name of an access point.
CVE-2017-1000023 1 Logicaldoc 1 Logicaldoc 2025-04-20 N/A
LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.
CVE-2017-9145 1 Tiki 1 Tikiwiki Cms\/groupware 2025-04-20 N/A
TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.
CVE-2017-9361 1 Websitebaker 1 Websitebaker 2025-04-20 N/A
WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.
CVE-2017-9085 1 Kodak 1 Insite 2025-04-20 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 6.5 to 8.0 allow remote attackers to inject arbitrary web script via the (1) "paramFile" parameter to /Site/Troubleshooting/DiagnosticReport.asp, or (2) "paramFile" parameter to /Site/Troubleshooting/SpeedTest.asp.