Export limit exceeded: 372131 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372131 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-59821 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 6.5 Medium |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, DNN’s URL/path handling and template rendering can allow specially crafted input to be reflected into a user profile that is returned to the browser. In these cases, the application does not sufficiently neutralize or encode characters that are meaningful in HTML, so an attacker can cause a victim’s browser to interpret attacker-controlled content as part of the page’s HTML. This issue has been patched in version 10.1.0. | ||||
| CVE-2025-59548 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 6.1 Medium |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, specially crafted URLs to the FileBrowser are vulnerable to javascript injection, affecting any unsuspecting user clicking such link. This issue has been patched in version 10.1.0. | ||||
| CVE-2025-59547 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 5.3 Medium |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the CKEditor file upload endpoint has insufficient sanitization for filenames allowing probing network endpoints. A specially crafted request can be made to upload a file with Unicode characters, which would be translated into a path that could expose resources in the internal network of the hosted site. This issue has been patched in version 10.1.0. | ||||
| CVE-2025-59546 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 2.4 Low |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, administrators and content editors can set html in module titles that could include javascript which could be used for XSS based attacks. This issue has been patched in version 10.1.0. | ||||
| CVE-2025-59545 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 9.1 Critical |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, the Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution (XSS). This issue has been patched in version 10.1.0. | ||||
| CVE-2025-59535 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 6.5 Medium |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, arbitrary themes can be loaded through query parameters. If an installed theme had a vulnerability, even if it was not used on any page, this could be loaded on unsuspecting clients without knowledge of the site owner. This issue has been patched in version 10.1.0. | ||||
| CVE-2024-40509 | 1 Openpetra | 1 Openpetra | 2025-09-29 | 7.3 High |
| Cross Site Scripting vulnerability in openPetra v.2023.02 allows a remote attacker to obtain sensitive information via the serverMFinDev.asmx function. | ||||
| CVE-2025-59539 | 1 Dnnsoftware | 2 Dnn Platform, Dotnetnuke | 2025-09-29 | 6.3 Medium |
| DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 10.1.0, when embedding information in the Biography field, even if that field is not rich-text, users could inject javascript code that would run in the context of the website and to any other user that can view the profile including administrators and/or superusers. This issue has been patched in version 10.1.0. | ||||
| CVE-2024-9133 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 6.6 Medium |
| A user with administrator privileges is able to retrieve authentication tokens | ||||
| CVE-2024-9132 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 8.1 High |
| The administrator is able to configure an insecure captive portal script | ||||
| CVE-2024-9131 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 7.2 High |
| A user with administrator privileges can perform command injection | ||||
| CVE-2024-47520 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 7.6 High |
| A user with advanced report application access rights can perform actions for which they are not authorized | ||||
| CVE-2024-47519 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 8.3 High |
| Backup uploads to ETM subject to man-in-the-middle interception | ||||
| CVE-2024-47518 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 6.4 Medium |
| Specially constructed queries targeting ETM could discover active remote access sessions | ||||
| CVE-2024-47517 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 6.8 Medium |
| Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access | ||||
| CVE-2024-9188 | 1 Arista | 1 Ng Firewall | 2025-09-29 | 8.8 High |
| Specially constructed queries cause cross platform scripting leaking administrator tokens | ||||
| CVE-2025-55111 | 2 Bmc, Linux | 3 Control-m/agent, Control-m\/agent, Linux Kernel | 2025-09-29 | 5.5 Medium |
| Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versions which were upgraded from an affected version. These files contain keys and passwords relating to SSL files, keystore and policies. An attacker with local access to the system running the Agent can access these files. | ||||
| CVE-2025-39867 | 1 Linux | 1 Linux Kernel | 2025-09-29 | 5.5 Medium |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2025-39799 | 1 Linux | 1 Linux Kernel | 2025-09-29 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2025-3231 | 1 Phpgurukul | 1 Zoo Management System | 2025-09-27 | 7.3 High |
| A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /aboutus.php. The manipulation of the argument pagetitle/pagedes leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||