Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (95197 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-29011 1 Dmasoftlab 1 Dma Radius Manager 2024-11-21 6.1 Medium
DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description, name, or address field (under admin.php).
CVE-2021-29010 1 Seopanel 1 Seo Panel 2024-11-21 4.8 Medium
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "report_type" parameter.
CVE-2021-29009 1 Seopanel 1 Seo Panel 2024-11-21 4.8 Medium
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the "type" parameter.
CVE-2021-29008 1 Seopanel 1 Seo Panel 2024-11-21 4.8 Medium
A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the "to_time" parameter.
CVE-2021-29003 1 Genexis 2 Platinum 4410, Platinum 4410 Firmware 2024-11-21 9.8 Critical
Genexis PLATINUM 4410 2.1 P4410-V2-1.28 devices allow remote attackers to execute arbitrary code via shell metacharacters to sys_config_valid.xgi, as demonstrated by the sys_config_valid.xgi?exeshell=%60telnetd%20%26%60 URI.
CVE-2021-29002 1 Plone 1 Plone 2024-11-21 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.
CVE-2021-28994 2 Kopano, Zarafa 2 Groupware Core, Zarafa 2024-11-21 7.5 High
kopano-ical (formerly zarafa-ical) in Kopano Groupware Core through 8.7.16, 9.x through 9.1.0, 10.x through 10.0.7, and 11.x through 11.0.1 and Zarafa 6.30.x through 7.2.x allows memory exhaustion via long HTTP headers.
CVE-2021-28979 1 Thalesgroup 1 Safenet Keysecure 2024-11-21 6.5 Medium
SafeNet KeySecure Management Console 8.12.0 is vulnerable to HTTP response splitting attacks. A remote attacker could exploit this vulnerability using specially-crafted URL to cause the server to return a split response, once the URL is clicked.
CVE-2021-28977 1 Get-simple 1 Getsimplecms 2024-11-21 4.8 Medium
Cross Site Scripting vulnerability in GetSimpleCMS 3.3.16 in admin/upload.php by adding comments or jpg and other file header information to the content of xla, pages, and gzip files,
CVE-2021-28975 1 Wpmailster 1 Wp Mailster 2024-11-21 6.1 Medium
WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page, for a crafted server_host, server_name, or connection_parameter parameter.
CVE-2021-28971 5 Debian, Fedoraproject, Linux and 2 more 10 Debian Linux, Fedora, Linux Kernel and 7 more 2024-11-21 5.5 Medium
In intel_pmu_drain_pebs_nhm in arch/x86/events/intel/ds.c in the Linux kernel through 5.11.8 on some Haswell CPUs, userspace applications (such as perf-fuzzer) can cause a system crash because the PEBS status in a PEBS record is mishandled, aka CID-d88d05a9e0b6.
CVE-2021-28968 1 Gnu 1 Punbb 2024-11-21 5.4 Medium
An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the [email] BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message.
CVE-2021-28963 2 Debian, Shibboleth 2 Debian Linux, Service Provider 2024-11-21 5.3 Medium
Shibboleth Service Provider before 3.2.1 allows content injection because template generation uses attacker-controlled parameters.
CVE-2021-28961 1 Openwrt 1 Openwrt 2024-11-21 8.8 High
applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in the DDNS package for OpenWrt 19.07 allows remote authenticated users to inject arbitrary commands via POST requests.
CVE-2021-28960 1 Manageengine 1 Desktop Central 2024-11-21 9.8 Critical
Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.
CVE-2021-28958 1 Zohocorp 1 Manageengine Adselfservice Plus 2024-11-21 9.8 Critical
Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.
CVE-2021-28935 1 Cmsmadesimple 1 Cms Made Simple 2024-11-21 5.4 Medium
CMS Made Simple (CMSMS) 2.2.15 allows authenticated XSS via the /admin/addbookmark.php script through the Site Admin > My Preferences > Title field.
CVE-2021-28927 2 Libretro, Microsoft 2 Retroarch, Windows 2024-11-21 7.8 High
The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function, which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.
CVE-2021-28924 1 Nagios 1 Network Analyzer 2024-11-21 6.1 Medium
Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.
CVE-2021-28918 2 Netmask Project, Redhat 2 Netmask, Acm 2024-11-21 9.1 Critical
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.