Export limit exceeded: 371190 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 371190 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371190 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-32162 | 1 Cmseasy | 1 Cmseasy | 2025-04-14 | 4.3 Medium |
| CMSeasy 7.7.7.9 is vulnerable to Arbitrary file deletion. | ||||
| CVE-2024-2102 | 1 Salonbookingsystem | 1 Salon Booking System | 2025-04-14 | 4.7 Medium |
| The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field and 'sms_prefix' parameter when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Bookings' page and the malicious script is executed in the admin context. | ||||
| CVE-2024-2101 | 1 Salonbookingsystem | 1 Salon Booking System | 2025-04-14 | 5.7 Medium |
| The Salon booking system WordPress plugin before 9.6.3 does not properly sanitize and escape the 'Mobile Phone' field when booking an appointment, allowing customers to conduct Stored Cross-Site Scripting attacks. The payload gets triggered when an admin visits the 'Customers' page and the malicious script is executed in the admin context. | ||||
| CVE-2024-30840 | 1 Tenda | 2 Ac15, Ac15 Firmware | 2025-04-14 | 6.5 Medium |
| A Stack Overflow vulnerability in Tenda AC15 v15.03.05.18 allows attackers to cause a denial of service via the LISTEN parameter in the fromDhcpListClient function. | ||||
| CVE-2023-40279 | 2 Openclinic, Openclinic Ga Project | 2 Ga, Openclinic Ga | 2025-04-14 | 7.5 High |
| An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to main.do. | ||||
| CVE-2023-40278 | 2 Openclinic, Openclinic Ga Project | 2 Ga, Openclinic Ga | 2025-04-14 | 7.5 High |
| An issue was discovered in OpenClinic GA 5.247.01. An Information Disclosure vulnerability has been identified in the printAppointmentPdf.jsp component of OpenClinic GA. By changing the AppointmentUid parameter, an attacker can determine whether a specific appointment exists based on the error message. | ||||
| CVE-2023-40280 | 1 Openclinic Ga Project | 1 Openclinic Ga | 2025-04-14 | 7.5 High |
| An issue was discovered in OpenClinic GA 5.247.01. An attacker can perform a directory path traversal via the Page parameter in a GET request to popup.jsp. | ||||
| CVE-2023-40277 | 1 Openclinic Ga Project | 1 Openclinic Ga | 2025-04-14 | 6.1 Medium |
| An issue was discovered in OpenClinic GA 5.247.01. A Reflected Cross-Site Scripting (XSS) vulnerability has been discovered in the login.jsp message parameter. | ||||
| CVE-2023-40276 | 1 Openclinic Ga Project | 1 Openclinic Ga | 2025-04-14 | 9.1 Critical |
| An issue was discovered in OpenClinic GA 5.247.01. An Unauthenticated File Download vulnerability has been discovered in pharmacy/exportFile.jsp. | ||||
| CVE-2023-40275 | 1 Openclinic Ga Project | 1 Openclinic Ga | 2025-04-14 | 9.1 Critical |
| An issue was discovered in OpenClinic GA 5.247.01. It allows retrieval of patient lists via queries such as findFirstname= to _common/search/searchByAjax/patientslistShow.jsp. | ||||
| CVE-2022-45778 | 1 Hillstonenet | 8 Sc-6000-wv02, Sc-6000-wv02 Firmware, Sc-6000-wv04 and 5 more | 2025-04-14 | 9.8 Critical |
| https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in the Hillstone WEB application firewall. An attacker can enter the background of the firewall with super administrator privileges through a configuration error in report.m. | ||||
| CVE-2022-45434 | 2 Dahuasecurity, Microsoft | 9 Dhi-dss4004-s2, Dhi-dss4004-s2 Firmware, Dhi-dss7016d-s2 and 6 more | 2025-04-14 | 5.9 Medium |
| Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access control policy, by sending a specific crafted packet to the vulnerable interface, an attacker could exploit the victim server to launch ICMP request attack to the designated target host. | ||||
| CVE-2022-45423 | 1 Dahuasecurity | 8 Dhi-dss4004-s2, Dhi-dss4004-s2 Firmware, Dhi-dss7016d-s2 and 5 more | 2025-04-14 | 7.5 High |
| Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending a specific crafted packet to the vulnerable interface (the credentials cannot be directly exploited). | ||||
| CVE-2021-24942 | 1 Menu Item Visibility Control Project | 1 Menu Item Visibility Control | 2025-04-14 | 7.2 High |
| The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment. | ||||
| CVE-2023-36238 | 1 Webkul | 1 Bagisto | 2025-04-14 | 6.5 Medium |
| Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter. | ||||
| CVE-2023-49989 | 2 Phpgurukul, Pratham-jaiswal | 2 Hotel Booking Management System, Hotel Booking Management System | 2025-04-14 | 9.8 Critical |
| Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php. | ||||
| CVE-2023-49988 | 2 Phpgurukul, Pratham-jaiswal | 2 Hotel Booking Management System, Hotel Booking Management System | 2025-04-14 | 7.5 High |
| Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php. | ||||
| CVE-2023-49540 | 1 Oretnom23 | 1 Book Store Management System | 2025-04-14 | 6.1 Medium |
| Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the history parameter. | ||||
| CVE-2023-49539 | 1 Oretnom23 | 1 Book Store Management System | 2025-04-14 | 6.1 Medium |
| Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the category parameter. | ||||
| CVE-2024-25763 | 1 Opennds | 1 Opennds | 2025-04-14 | 5.5 Medium |
| openNDS 10.2.0 is vulnerable to Use-After-Free via /openNDS/src/auth.c. | ||||