Search

Expected end of text, found ',' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (382401 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2023-45465 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 9.8 Critical
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.
CVE-2023-45464 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 7.5 High
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2023-45463 1 Netis-systems 2 N3m, N3m Firmware 2024-11-21 7.5 High
Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2023-45396 1 Elenos 3 Etg150, Etg150 Firmware, Etg150 Fm 2024-11-21 6.5 Medium
An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version 3.12.
CVE-2023-45394 1 Small Crm Project 1 Small Crm 2024-11-21 5.4 Medium
Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker to store and execute malicious javascript code in the Admin panel which leads to Admin account takeover.
CVE-2023-45393 1 Grandingteco 1 Utime Master 2024-11-21 6.5 Medium
An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive information via a crafted cookie.
CVE-2023-45391 1 Grandingteco 1 Utime Master 2024-11-21 4.8 Medium
A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the First Name parameter.
CVE-2023-45387 1 Myprestamodules 1 Exportproducts 2024-11-21 9.8 Critical
In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection via `exportProduct::_addDataToDb().`
CVE-2023-45386 1 Mypresta 1 Product Extra Tabs Pro 2024-11-21 9.8 Critical
In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via `extratabspro::searchcategory()`, `extratabspro::searchproduct()` and `extratabspro::searchmanufacturer().'
CVE-2023-45384 1 Knowband 1 Supercheckout 2024-11-21 9.8 Critical
KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .php
CVE-2023-45383 1 Common-services 1 Sonice Etiquetage 2024-11-21 7.5 High
In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
CVE-2023-45382 2 Common-services, Sonice Retour 2 Sonice Retour, Common Services For Prestashop 2024-11-21 7.5 High
In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
CVE-2023-45381 1 Webshopworks 1 Creativepopup 2024-11-21 9.8 Critical
In the module "Creative Popup" (creativepopup) up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via `cp_download_popup().`
CVE-2023-45380 1 Silbersaiten 1 Order Duplicator 2024-11-21 9.1 Critical
In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions control, a guest can download personal information from ps_customer/ps_address tables such as name / surname / phone number / full postal address.
CVE-2023-45378 1 Hdclic 1 Prestablog 2024-11-21 9.8 Critical
In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_positions.php has a sensitive SQL call that can be executed with a trivial http call and exploited to forge a SQL injection.
CVE-2023-45376 1 Hipresta 1 Carousels Pack 2024-11-21 9.8 Critical
In the module "Carousels Pack - Instagram, Products, Brands, Supplier" (hicarouselspack) for PrestaShop up to version 1.5.0 from HiPresta for PrestaShop, a guest can perform SQL injection via HiCpProductGetter::getViewedProduct().`
CVE-2023-45375 1 01generator 1 Pireospay 2024-11-21 8.8 High
In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().`
CVE-2023-45374 1 Mediawiki 1 Mediawiki 2024-11-21 5.3 Medium
An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not check for the anti-CSRF edit token in Special:SportsTeamsManager and Special:UpdateFavoriteTeams.
CVE-2023-45373 1 Mediawiki 1 Mediawiki 2024-11-21 6.1 Medium
An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators.
CVE-2023-45372 1 Mediawiki 1 Mediawiki 2024-11-21 5.3 Medium
An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running (e.g., AbuseFilter).