Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (17565 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-17133 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the rewrite url setting.
CVE-2018-17132 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/goods_update.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue[] array parameter.
CVE-2018-17131 1 Phpmywind 1 Phpmywind 2024-11-21 N/A
admin/web_config.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the varvalue field.
CVE-2018-17126 1 Chshcms 1 Cscms 2024-11-21 N/A
CScms 4.1 allows remote code execution, as demonstrated by 1');eval($_POST[cmd]);# in Web Name to upload\plugins\sys\Install.php.
CVE-2018-17036 1 Ucms Project 1 Ucms 2024-11-21 9.8 Critical
An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php, as demonstrated by injecting a phpinfo() call into /inc/config.php.
CVE-2018-17030 1 Bigtreecms 1 Bigtree Cms 2024-11-21 N/A
BigTree CMS 4.2.23 allows remote authenticated users, if possessing privileges to set hooks, to execute arbitrary code via /core/admin/auto-modules/forms/process.php.
CVE-2018-16975 1 Elefantcms 1 Elefant 2024-11-21 N/A
An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in /designer/add/stylesheet.php by using a .php extension in the New Stylesheet Name field in conjunction with <?php content, because of insufficient input validation in apps/designer/handlers/csspreview.php.
CVE-2018-16794 1 Microsoft 2 Active Directory Federation Services, Windows Server 2016 2024-11-21 N/A
Microsoft ADFS 4.0 Windows Server 2016 and previous (Active Directory Federation Services) has an SSRF vulnerability via the txtBoxEmail parameter in /adfs/ls.
CVE-2018-16793 1 Microsoft 1 Exchange Server 2024-11-21 N/A
Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.
CVE-2018-16785 1 Dedecms 1 Dedecms 2024-11-21 N/A
XML injection vulnerability exists in the file of DedeCMS V5.7 SP2 version, which can be utilized by attackers to create script file to obtain webshell
CVE-2018-16784 1 Dedecms 1 Dedecms 2024-11-21 N/A
DedeCMS 5.7 SP2 allows XML injection, and resultant remote code execution, via a "<file type='file' name='../" substring.
CVE-2018-16771 1 Hoosk 1 Hoosk 2024-11-21 N/A
Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php.
CVE-2018-16621 1 Sonatype 1 Nexus Repository Manager 2024-11-21 7.2 High
Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
CVE-2018-16604 1 Nibbleblog 1 Nibbleblog 2024-11-21 N/A
An issue was discovered in Nibbleblog v4.0.5. With an admin's username and password, an attacker can execute arbitrary PHP code by changing the username because the username is surrounded by double quotes (e.g., "${phpinfo()}").
CVE-2018-16444 1 Seacms 1 Seacms 2024-11-21 N/A
An issue was discovered in SeaCMS 6.61. adm1n/admin_reslib.php has SSRF via the url parameter.
CVE-2018-16409 1 Gogs 1 Gogs 2024-11-21 N/A
In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF.
CVE-2018-16343 1 Seacms 1 Seacms 2024-11-21 N/A
SeaCMS 6.61 allows remote attackers to execute arbitrary code because parseIf() in include/main.class.php does not block use of $GLOBALS.
CVE-2018-16168 1 Jpcert 1 Logontracer 2024-11-21 N/A
LogonTracer 1.2.0 and earlier allows remote attackers to conduct Python code injection attacks via unspecified vectors.
CVE-2018-15911 5 Artifex, Canonical, Debian and 2 more 12 Ghostscript, Gpl Ghostscript, Ubuntu Linux and 9 more 2024-11-21 N/A
In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter or potentially execute code.
CVE-2018-15895 1 Icmsdev 1 Icms 2024-11-21 N/A
An SSRF vulnerability was discovered in idreamsoft iCMS 7.0.11 because the remote function in app/spider/spider_tools.class.php does not block DNS hostnames associated with private and reserved IP addresses, as demonstrated by 127.0.0.1 in an A record. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-14858.