Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94738 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2020-19048 1 Mybb 1 Mybb 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'.
CVE-2020-19046 1 S-cms 1 S-cms 2024-11-21 5.4 Medium
Cross Site Scripting (XSS) in S-CMS v1.0 allows remote attackers to execute arbitrary code via the component '/admin/tpl.php?page='.
CVE-2020-19042 1 Zzcms 1 Zzcms 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.
CVE-2020-19007 1 Halo 1 Halo 2024-11-21 5.4 Medium
Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser.
CVE-2020-19002 1 Jupo 1 Mezzanine 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the component 'admin/blog/blogpost/add/'. This issue is different than CVE-2018-16632.
CVE-2020-19001 1 Simiki Project 1 Simiki 2024-11-21 9.8 Critical
Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'.
CVE-2020-19000 1 Simiki Project 1 Simiki 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiki/blob/master/simiki/generators.py'.
CVE-2020-18999 1 Blog Mini Project 1 Blog Mini 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/submit-articles'.
CVE-2020-18998 1 Blog Mini Project 1 Blog Mini 2024-11-21 6.1 Medium
Cross Site Scripting (XSS) in Blog_mini v1.0 allows remote attackers to execute arbitrary code via the component '/admin/custom/blog-plugin/add'.
CVE-2020-18984 1 Synacor 1 Zimbra Collaboration Suite 2024-11-21 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the zimbraAdmin/public/secureRequest.jsp component of Zimbra Collaboration 8.8.12 allows unauthenticated attackers to execute arbitrary web scripts or HTML via a host header injection.
CVE-2020-18982 1 Halo 1 Halo 2024-11-21 5.4 Medium
Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
CVE-2020-18979 1 Halo 1 Halo 2024-11-21 6.1 Medium
Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.
CVE-2020-18971 1 Podofo Project 1 Podofo 2024-11-21 5.5 Medium
Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers to cause a denial of service via the component 'src/base/PdfDictionary.cpp:65'.
CVE-2020-18900 1 Libexe Project 1 Libexe 2024-11-21 3.3 Low
A heap-based buffer overflow in the libexe_io_handle_read_coff_optional_header function of libyal libexe before 20181128. NOTE: the vendor has disputed this as described in libyal/libexe issue 1 on GitHub
CVE-2020-18899 1 Exiv2 1 Exiv2 2024-11-21 6.5 Medium
An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of service (DOS) via a crafted input.
CVE-2020-18898 2 Exiv2, Redhat 2 Exiv2, Enterprise Linux 2024-11-21 6.5 Medium
A stack exhaustion issue in the printIFDStructure function of Exiv2 0.27 allows remote attackers to cause a denial of service (DOS) via a crafted file.
CVE-2020-18885 1 Phpmywind 1 Phpmywind 2024-11-21 7.2 High
Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the "text color" field of the component '/admin/web_config.php'.
CVE-2020-18875 1 Dotcms 1 Dotcms 2024-11-21 8.8 High
Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl (velocity) files.
CVE-2020-18839 1 Freedesktop 1 Poppler 2024-11-21 6.5 Medium
Buffer Overflow vulnerability in HtmlOutputDev::page in poppler 0.75.0 allows attackers to cause a denial of service.
CVE-2020-18831 1 Exiv2 1 Exiv2 2024-11-21 7.8 High
Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of service and other unspecified impacts via use of crafted file.