Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Serviio PRO 1.8 contains an information disclosure vulnerability due to improper access control enforcement in the Configuration REST API that allows unauthenticated a…Check if you run itEPSS 0.69%Mar 16, 2026
- Medium5.1Wowza Streaming Engine 4.5.0 contains multiple reflected cross-site scripting vulnerabilities in the enginemanager interface where input passed through various paramet…Check if you run itEPSS 0.25%Mar 16, 2026
- Medium6.9Wowza Streaming Engine 4.5.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by crafting malicious web pages.Check if you run itEPSS 0.16%Mar 16, 2026
- High8.7Wowza Streaming Engine 4.5.0 contains a privilege escalation vulnerability that allows authenticated read-only users to elevate privileges to administrator by manipula…Check if you run itEPSS 0.22%Mar 16, 2026
- High8.5Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable files d…Check if you run itEPSS 0.22%Mar 16, 2026
- Medium5.1ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting…Check if you run itEPSS 0.27%Mar 16, 2026
- Medium6.8ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofin…Check if you run itEPSS 0.15%Mar 16, 2026
- Critical9.3ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters v…Check if you run itEPSS 0.58%Mar 16, 2026
- Medium6.9ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources.Check if you run itEPSS 0.21%Mar 16, 2026
- Medium5.3ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into v…Check if you run itEPSS 0.22%Mar 16, 2026
- Medium5.1ZKTeco ZKBioSecurity 3.0 contains multiple reflected cross-site scripting vulnerabilities that allow attackers to execute arbitrary HTML and script code by injecting m…Check if you run itEPSS 0.26%Mar 16, 2026
- Critical9.3ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application.Check if you run itEPSS 0.81%Mar 16, 2026
- High8.7ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files.Check if you run itEPSS 0.46%Mar 16, 2026
- Critical9.3ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files.Check if you run itEPSS 0.76%Mar 16, 2026
- High8.8RealtyScript 4.0.2 Multiple Time-based Blind SQL InjectionCheck if you run itEPSS 0.43%Mar 15, 2026
- High8.8RealtyScript 4.0.2 SQL Injection via u_id and agent ParametersCheck if you run itEPSS 0.43%Mar 15, 2026
- Medium5.1RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.phpCheck if you run itEPSS 0.21%Mar 15, 2026
- Medium5.1Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerability in the location_name parameter of the admin locations interface.Check if you run itEPSS 0.33%Mar 15, 2026
- Medium6.9RealtyScript 4.0.2 Cross-Site Request Forgery Unauthorized User CreationCheck if you run itEPSS 0.21%Mar 15, 2026
- Medium5.1RealtyScript 4.0.2 Stored Cross-Site Scripting via CSV File Upload FilenameCheck if you run itEPSS 0.25%Mar 15, 2026
- Medium5.1Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php.Check if you run itEPSS 0.28%Mar 15, 2026
- Medium5.1RealtyScript 4.0.2 Cross-Site Scripting via Multiple ParametersCheck if you run itEPSS 0.29%Mar 15, 2026
- Medium6.9RealtyScript 4.0.2 Multiple Cross-Site Request Forgery and Persistent Cross-Site Scripting VulnerabilitiesCheck if you run itEPSS 0.19%Mar 15, 2026
- High8.7Qool CMS Multiple Persistent Cross-Site Scripting VulnerabilitiesCheck if you run itEPSS 0.38%Mar 15, 2026
- Medium6.9Qool CMS 2.0 RC2 Cross-Site Request Forgery via adduserCheck if you run itEPSS 0.25%Mar 15, 2026
Sort