Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (47999 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-42099 1 Klik Project 1 Klik 2025-04-25 5.4 Medium
KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input.
CVE-2022-37721 1 Pyrocms 1 Pyrocms 2025-04-25 9 Critical
PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation.
CVE-2022-37720 1 Orchardcore 1 Orchard Cms 2025-04-25 9 Critical
Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted html and javascript payload in a blog post, leading to full admin account takeover or privilege escalation when the malicious blog post is loaded in the victim's browser.
CVE-2022-0698 1 Microweber 1 Microweber 2025-04-25 6.1 Medium
Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
CVE-2022-29827 1 Mitsubishielectric 1 Gx Works3 2025-04-25 6.8 Medium
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project files or execute programs illegally.
CVE-2022-29828 1 Mitsubishielectric 1 Gx Works3 2025-04-25 6.8 Medium
Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to disclose sensitive information. As a result, unauthenticated attackers may view programs and project file or execute programs illegally.
CVE-2022-29831 1 Mitsubishielectric 1 Gx Works3 2025-04-25 7.5 High
Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker to obtain information about the project file for MELSEC safety CPU modules.
CVE-2022-42100 1 Klik Project 1 Klik 2025-04-25 5.4 Medium
KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location input reply-form.
CVE-2022-44279 1 Garage Management System Project 1 Garage Management System 2025-04-25 6.1 Medium
Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.
CVE-2022-39240 1 Mygraph Project 1 Mygraph 2025-04-25 5.4 Medium
MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.
CVE-2022-44355 1 Contec 2 Solarview Compact, Solarview Compact Firmware 2025-04-25 6.1 Medium
SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.
CVE-2022-44096 1 Sanitization Management System Project 1 Sanitization Management System 2025-04-25 9.8 Critical
Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVE-2022-36433 1 Amasty 1 Amasty Blog Pro 2025-04-25 6.1 Medium
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against admin panel users via posts/preview or posts/save.
CVE-2022-36137 1 Churchcrm 1 Churchcrm 2025-04-25 4.8 Medium
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader.
CVE-2022-36136 1 Churchcrm 1 Churchcrm 2025-04-25 4.8 Medium
ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment.
CVE-2021-31740 1 Seppmail 1 Seppmail 2025-04-25 6.1 Medium
SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS).
CVE-2020-21219 1 Netgate 2 Acme, Pfsense 2025-04-25 6.1 Medium
Cross Site Scripting (XSS) vulnerability in Netgate pf Sense 2.4.4-Release-p3 and Netgate ACME package 0.6.3 allows remote attackers to to run arbitrary code via the RootFolder field to acme_certificate_edit.php page of the ACME package.
CVE-2022-45050 1 Axiell 1 Iguana 2025-04-25 6.1 Medium
A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitter.php endpoint does not properly neutralise user input, resulting in the vulnerability.
CVE-2022-44959 1 Webtareas Project 1 Webtareas 2025-04-24 5.4 Medium
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
CVE-2022-44957 1 Webtareas Project 1 Webtareas 2025-04-24 5.4 Medium
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.