Export limit exceeded: 370959 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 370959 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370959 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-47929 | 3 Bestwebsoft, Filterable-portfolio, Wordpress | 3 Portfolio, Filterable Portfolio Gallery, Wordpress | 2026-07-28 | 6.4 Medium |
| Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Attackers can store JavaScript code like image tags with onerror handlers that execute when the gallery is previewed, affecting all users viewing the page. | ||||
| CVE-2021-47922 | 2 Soliloquywp, Wordpress | 3 Slider, Slider By Soliloquy, Wordpress | 2026-07-28 | 6.4 Medium |
| Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages. | ||||
| CVE-2021-47904 | 1 Phreesoft | 1 Phreebookserp | 2026-07-28 | 8.8 High |
| PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server. | ||||
| CVE-2021-47894 | 2 Jenkins, Northwest Performance Software | 2 Performance, Managed Switch Port Mapping Tool | 2026-07-28 | 7.5 High |
| Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buffer. Attackers can generate a 10,000-character buffer and paste it into the IP Address and SNMP Community Name fields to trigger the application crash. | ||||
| CVE-2021-47854 | 1 Dd-wrt | 1 Dd-wrt | 2026-07-28 | 9.8 Critical |
| DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code. Attackers can send crafted M-SEARCH packets with oversized UUID payloads to trigger buffer overflow conditions on the target device. | ||||
| CVE-2021-47816 | 1 Thecus | 2 N4800eco, N4800eco Nas Server Control Panel | 2026-07-28 | 8.8 High |
| Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands through user management endpoints. Attackers can inject commands via username and batch user creation parameters to execute shell commands with administrative privileges. | ||||
| CVE-2021-47807 | 2 Flexense, Syncbreeze | 3 Sync Breeze, Syncbreeze, Sync Breeze | 2026-07-28 | 7.8 High |
| Sync Breeze 13.6.18 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in service binaries located in 'Program Files' directories to inject malicious executables and escalate privileges. | ||||
| CVE-2021-47806 | 2 Dupscout, Flexense | 3 Dup Scout, Dup Scout, Dupscout | 2026-07-28 | 7.8 High |
| Dup Scout 13.5.28 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Dup Scout Server\bin\dupscts.exe' to inject malicious executables and escalate privileges. | ||||
| CVE-2021-47799 | 1 Visual-tools | 2 Dvr Vx16, Dvr Vx16 Firmware | 2026-07-28 | 6.2 Medium |
| Visual Tools DVR VX16 version 4.2.28 contains a local privilege escalation vulnerability in its Sudo configuration that allows attackers to gain root access. Attackers can exploit the unsafe Sudo settings by using mount commands to bind a shell, enabling unauthorized system-level privileges. | ||||
| CVE-2021-47782 | 2 Odinesolutions, Openpolicyagent | 2 Gatekeeper, Gatekeeper | 2026-07-28 | 8.2 High |
| Odine Solutions GateKeeper 1.0 contains a SQL injection vulnerability in the trafficCycle API endpoint that allows remote attackers to inject malicious database queries. Attackers can exploit the vulnerability by sending crafted payloads to the /rass/api/v1/trafficCycle/ endpoint to manipulate PostgreSQL database queries and potentially extract sensitive information. | ||||
| CVE-2021-47751 | 2 Cutesoft, Phphtmledit | 3 Cute Editor, Cuteeditor, Rich Text Editor | 2026-07-28 | 7.5 High |
| CuteEditor for PHP (now referred to as Rich Text Editor) 6.6 contains a directory traversal vulnerability in the browse template feature that allows attackers to write files to arbitrary web root directories. Attackers can exploit the ServerMapPath() function by renaming uploaded HTML files using directory traversal sequences to write files outside the intended template directory. | ||||
| CVE-2021-47748 | 2 Graphql, Hasura | 2 Graphql, Graphql Engine | 2026-07-28 | 9.8 Critical |
| Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. Attackers can inject commands into the run_sql endpoint by crafting malicious GraphQL queries that execute system commands through PostgreSQL's COPY FROM PROGRAM functionality. | ||||
| CVE-2021-47725 | 1 Stvs | 1 Provision | 2026-07-28 | 5.4 Medium |
| STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the affected site. | ||||
| CVE-2020-37252 | 2 Dell, Realtek | 2 Realtek High Definition Audio Driver, Realtek Audio Service | 2026-07-28 | 7.8 High |
| Realtek Audio Service 1.0.0.55 contains an unquoted service path vulnerability in RtkAudioService64.exe that allows local attackers to escalate privileges by injecting malicious code. Attackers can place executable files in the unquoted service path directory to execute arbitrary code with LocalSystem privileges during service startup or system reboot. | ||||
| CVE-2020-37244 | 3 Ithemes, Supsystic, Wordpress | 3 Membership, Membership, Wordpress | 2026-07-28 | 8.2 High |
| Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'search' and 'sidx' parameters. Attackers can send GET requests to the badges module with crafted payloads to extract sensitive database information using time-based blind or UNION-based SQL injection techniques. | ||||
| CVE-2020-37227 | 3 10web, Heliossolutions, Wordpress | 3 Slider, Hs Brand Logo Slider, Wordpress | 2026-07-28 | 8.8 High |
| HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploading arbitrary files. Attackers can intercept upload requests to the logoupload parameter in the admin interface and rename files to executable extensions .php to achieve remote code execution. | ||||
| CVE-2020-37223 | 2 Iobit, Revouninstaller | 2 Uninstaller, Uninstaller | 2026-07-28 | 7.8 High |
| IObit Uninstaller 9.5.0.15 contains an unquoted service path vulnerability in the IObitUnSvr service that allows local attackers to escalate privileges to SYSTEM level. Attackers can place a malicious executable named IObit.exe in the C:\Program Files (x86)\IObit directory and restart the service to execute code with SYSTEM privileges. | ||||
| CVE-2020-37206 | 1 Nsasoft | 2 Nsauditor Sharealarmpro Advanced Network Access Control, Sharealarmpro | 2026-07-28 | 7.5 High |
| ShareAlarmPro contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized registration key. Attackers can generate a 1000-character buffer payload to trigger an application crash when pasted into the registration key field. | ||||
| CVE-2020-37141 | 3 Amss++ Project, Amss\+\+ Project, Amssplus | 3 Amss++, Amss\+\+, Amss Plus | 2026-07-28 | 8.2 High |
| AMSS++ version 4.31 contains a SQL injection vulnerability in the mail module's maildetail.php script through the 'id' parameter. Attackers can manipulate the 'id' parameter in /modules/mail/main/maildetail.php to inject malicious SQL queries and potentially access or modify database contents. | ||||
| CVE-2020-37121 | 1 Codeblocks | 2 Code::blocks, Code\\ | 2026-07-28 | 5.5 Medium |
| CODE::BLOCKS 16.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting Structured Exception Handler with crafted Unicode characters. Attackers can create a malicious M3U playlist file with 536 bytes of buffer and shellcode to trigger remote code execution. | ||||