Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (95185 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-27600 1 Sap 1 Manufacturing Execution 2024-11-21 5.4 Medium
SAP Manufacturing Execution (System Rules), versions - 15.1, 15.2, 15.3, 15.4, allows an authorized attacker to embed malicious code into HTTP parameter and send it to the server because SAP Manufacturing Execution (System Rules) tab does not sufficiently encode some parameters, resulting in Stored Cross-Site Scripting (XSS) vulnerability. The malicious code can be used for different purposes. e.g., information can be read, modified, and sent to the attacker. However, availability of the server cannot be impacted.
CVE-2021-27578 1 Apache 1 Zeppelin 2024-11-21 6.1 Medium
Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.
CVE-2021-27564 1 Appspace 1 Appspace 2024-11-21 5.4 Medium
A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups section of the network tab, it is stored as the group name. Whenever another member visits that group, this payload executes.
CVE-2021-27559 1 Monicahq 1 Monica 2024-11-21 5.4 Medium
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.
CVE-2021-27558 1 Easycorp 1 Zentao 2024-11-21 6.1 Medium
A cross site scripting (XSS) issue in EasyCorp ZenTao 12.5.3 allows remote attackers to execute arbitrary web script via various areas such as data-link-creator.
CVE-2021-27556 1 Easycorp 1 Zentao 2024-11-21 7.2 High
The Cron job tab in EasyCorp ZenTao 12.5.3 allows remote attackers (who have admin access) to execute arbitrary code by setting the type parameter to System.
CVE-2021-27544 1 Phpgurukul 1 Beauty Parlour Management System 2024-11-21 4.8 Medium
Cross Site Scripting (XSS) in the "add-services.php" component of PHPGurukul Beauty Parlour Management System v1.0 allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the "sername" parameter.
CVE-2021-27531 1 Dynpg 1 Dynpg 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "query" parameter.
CVE-2021-27530 1 Dynpg 1 Dynpg 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.
CVE-2021-27529 1 Dynpg 1 Dynpg 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "limit" parameter.
CVE-2021-27528 1 Dynpg 1 Dynpg 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "refID" parameter.
CVE-2021-27527 1 Dynpg 1 Dynpg 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "valueID" parameter.
CVE-2021-27526 1 Dynpg 1 Dynpg 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the "page" parameter.
CVE-2021-27524 1 Margox 1 Braft-editor 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embed media feature.
CVE-2021-27520 1 Fudforum 1 Fudforum 2024-11-21 6.1 Medium
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "author" parameter.
CVE-2021-27519 1 Fudforum 1 Fudforum 2024-11-21 6.1 Medium
A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the "srch" parameter.
CVE-2021-27517 1 Foxit 2 Phantompdf, Reader 2024-11-21 6.1 Medium
Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API).
CVE-2021-27503 1 Ypsomed 2 Mylife, Mylife Cloud 2024-11-21 4.8 Medium
Ypsomed mylife Cloud, mylife Mobile Application, Ypsomed mylife Cloud: All versions prior to 1.7.2, Ypsomed mylife App: All versions prior to 1.7.5,The application encrypts on the application layer of the communication protocol between the Ypsomed mylife App and mylife Cloud credentials based on hard-coded secrets, which allows man-in-the-middle attackers to tamper with messages.
CVE-2021-27488 3 Datakit, Luxion, Siemens 6 Crosscadware, Keyshot, Solid Edge Se2020 and 3 more 2024-11-21 7.8 High
Datakit Software libraries CatiaV5_3dRead, CatiaV6_3dRead, Step3dRead, Ug3dReadPsr, Jt3dReadPsr modules in KeyShot Versions v10.1 and prior lack proper validation of user-supplied data when parsing CATPart files. This could result in an out-of-bounds write past the end of an allocated structure. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVE-2021-27483 1 Zoll 1 Defibrillator Dashboard 2024-11-21 7.8 High
ZOLL Defibrillator Dashboard, v prior to 2.2,The affected products contain insecure filesystem permissions that could allow a lower privilege user to escalate privileges to an administrative level user.