Export limit exceeded: 364918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (364918 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-33296 | 1 Wwbn | 1 Avideo | 2026-03-25 | 6.1 Medium |
| WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site. Version 26.0 fixes the issue. | ||||
| CVE-2024-51222 | 1 Phpgurukul | 1 Vehicle Record Management System | 2026-03-25 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter. | ||||
| CVE-2024-51223 | 1 Phpgurukul | 1 Vehicle Record Management System | 2026-03-25 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Mobile Number parameter. | ||||
| CVE-2024-51224 | 1 Phpgurukul | 1 Vehicle Record Management System | 2026-03-25 | 4.8 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in the component /admin/edit-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the vehiclename, modelnumber, regnumber, vehiclesubtype, chasisnum and enginenumber parameters. | ||||
| CVE-2024-51225 | 1 Phpgurukul | 1 Vehicle Record Management System | 2026-03-25 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component /admin/add-brand.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the brandname parameter. | ||||
| CVE-2024-51226 | 1 Phpgurukul | 1 Vehicle Record Management System | 2026-03-25 | 6.1 Medium |
| A stored cross-site scripting (XSS) vulnerability in the component /admin/search-vehicle.php of Phpgurukul Vehicle Record Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Search parameter. | ||||
| CVE-2026-26828 | 1 Owntone | 1 Owntone-server | 2026-03-25 | 7.5 High |
| A NULL pointer dereference in the daap_reply_playlists function (src/httpd_daap.c) of owntone-server commit 3d1652d allows attackers to cause a Denial of Service (DoS) via sending a crafted DAAP request to the server | ||||
| CVE-2026-26829 | 1 Owntone | 1 Owntone-server | 2026-03-25 | 7.5 High |
| A NULL pointer dereference in the safe_atou64 function (src/misc.c) of owntone-server through commit c4d57aa allows attackers to cause a Denial of Service (DoS) via sending a series of crafted HTTP requests to the server. | ||||
| CVE-2026-4606 | 1 Geovision | 1 Gv-edge Recording Manager | 2026-03-25 | N/A |
| GV Edge Recording Manager (ERM) v2.3.1 improperly runs application components with SYSTEM-level privileges, allowing any local user to gain full control of the operating system. During installation, ERM creates a Windows service that runs under the LocalSystem account. When the ERM application is launched, related processes are spawned under SYSTEM privileges rather than the security context of the logged-in user. Functions such as 'Import Data' open a Windows file dialog operating with SYSTEM permissions, enabling modification or deletion of protected system files and directories. Any ERM function invoking Windows file open/save dialogs exposes the same risk. This vulnerability allows local privilege escalation and may result in full system compromise. | ||||
| CVE-2026-4601 | 2 Jsrsasign Project, Kjur | 2 Jsrsasign, Jsrsasign | 2026-03-25 | 8.7 High |
| Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then solves for x from the resulting signature. | ||||
| CVE-2026-4603 | 2 Jsrsasign Project, Kjur | 2 Jsrsasign, Jsrsasign | 2026-03-25 | 5.9 Medium |
| Versions of the package jsrsasign before 11.1.1 are vulnerable to Division by zero due to the RSASetPublic/KEYUTIL parsing path in ext/rsa.js and the BigInteger.modPowInt reduction logic in ext/jsbn.js. An attacker can force RSA public-key operations (e.g., verify and encryption) to collapse to deterministic zero outputs and hide “invalid key” errors by supplying a JWK whose modulus decodes to zero. | ||||
| CVE-2026-3587 | 1 Wago | 16 Industrial Managed Switch 852-1305, Industrial Managed Switch 852-1305-000-001, Industrial Managed Switch 852-1505 and 13 more | 2026-03-25 | 10 Critical |
| An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device. | ||||
| CVE-2026-32968 | 3 Helmholz, Mb Connect Line, Mbconnectline | 4 Myrex24.virtual, Myrex24 V2, Mb Connect Line Mbconnect24 and 1 more | 2026-03-25 | 9.8 Critical |
| Due to the improper neutralisation of special elements used in an OS command, an unauthenticated remote attacker can exploit an RCE vulnerability in the com_mb24sysapi module, resulting in full system compromise. This vulnerability is a variant attack for CVE-2020-10383. | ||||
| CVE-2026-32969 | 2 Helmholz, Mbconnectline | 4 Myrex24.virtual, Myrex24 V2, Mbconnect24 and 1 more | 2026-03-25 | 7.5 High |
| An unauthenticated remote attacker can exploit a Pre-Auth blind SQL Injection vulnerability in the userinfo endpoint’s authentication method due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. | ||||
| CVE-2025-41007 | 1 Cuantis | 1 Cuantis | 2026-03-25 | N/A |
| SQL Injection in Cuantis. This vulnerability allows an attacker to retrieve, create, update and delete databases through the 'search' parameter in the '/search.php' endpoint. | ||||
| CVE-2026-1958 | 1 Bri | 2 Klinikaxp, Klinikaxp Insertino | 2026-03-25 | N/A |
| Use of hard-coded credentials in Klinika XP and KlinikaXP Insertino allowed an unauthorized attacker access to several internal services. Critically, this included access to the FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a legitimate update. This issue affects KlinikaXP: before 5.39.01.01. and KlinikaXP Insertino before 3.1.0.1 Beside removing the hardcoded credentials from the code, previously exposed credentials were also rotated preventing further attack attempts. | ||||
| CVE-2025-41008 | 1 Sinturno | 1 Sinturno | 2026-03-25 | N/A |
| SQL injection vulnerability in Sinturno. This vulnerability allows an attacker to retrieve, create, update, and delete databases through the 'client' parameter in the '/_adm/scripts/modalReport_data.php' endpoint. | ||||
| CVE-2026-33297 | 1 Wwbn | 1 Avideo | 2026-03-25 | 9.1 Critical |
| WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control. Version 26.0 contains a patch for the issue. | ||||
| CVE-2019-25620 | 1 Pixarra | 1 Tree Studio | 2026-03-25 | 6.2 Medium |
| Tree Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters during application runtime, causing the application to become unresponsive or terminate abnormally. | ||||
| CVE-2019-25621 | 1 Pixarra | 1 Pixel Studio | 2026-03-25 | 6.2 Medium |
| Pixel Studio 2.17 contains a denial of service vulnerability that allows local attackers to crash the application by providing malformed input through the keyboard interface. Attackers can trigger the vulnerability by entering arbitrary characters, causing the application to become unresponsive or terminate abnormally. | ||||