Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters.Check if you run itEPSS 0.20%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in contact.php via the txtname, txtphone, and txtmail parameters.Check if you run itEPSS 0.35%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the password2 parameter in func.php.Check if you run itEPSS 0.35%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain multiple SQL injection vulnerabilities in func1.php via the username3 and password3 parameters.Check if you run itEPSS 0.35%Aug 7, 2025
- Critical9.8Hospital Management System v4 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.Check if you run itEPSS 0.35%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the emailAddress parameter at createClassTeacher.php.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createStudents.php via the Id, firstname, and admissionNumber parametersCheck if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createSessionTerm.php via the id, termId, and sessionName parameters.Check if you run itEPSS 0.30%Aug 7, 2025
- High8.8Student Attendance Management System v1 was discovered to contain multiple SQL injection vulnerabilities in createClassArms.php via the classId and classArmName parameters.Check if you run itEPSS 0.30%Aug 7, 2025
- Medium6.1Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm.php.Check if you run itEPSS 0.20%Aug 7, 2025
- Medium6.5Hospital Management System 4 is vulnerable to a SQL injection in /Hospital-Management-System-master/func.php via the password2 parameter.Check if you run itEPSS 0.22%Aug 7, 2025
- High8.1A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface.Check this weekEPSS 13.65%Aug 6, 2025
- Medium6.5MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.Check this weekEPSS 25.00%Aug 6, 2025
- Medium6.5A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter in the backend templCheck this weekEPSS 47.00%Aug 6, 2025
- Medium6.0FPDI is a collection of PHP classes that facilitate reading pages from existing PDF documents and using them as templates in FPDF.Check this weekEPSS 31.00%Aug 5, 2025
- Critical10.0The WordPress plugin Asset-Manager version 2.0 and below contains an unauthenticated arbitrary file upload vulnerability in upload.php.Check if you run itEPSS 1.72%Aug 5, 2025
- Critical10.0The WordPress plugin Advanced Custom Fields (ACF) version 3.5.1 and below contains a remote file inclusion (RFI) vulnerability in core/actions/export.php.Check if you run itEPSS 1.84%Aug 5, 2025
- Critical10.0PHP-Charts v1.0 contains a PHP code execution vulnerability in wizard/url.php, where user-supplied GET parameter names are passed directly to eval() without sanitization.Check if you run itEPSS 2.10%Aug 5, 2025
- Critical9.3Narcissus is vulnerable to remote code execution via improper input handling in its image configuration workflow.Check if you run itEPSS 1.71%Aug 5, 2025
- Critical10.0An unauthenticated arbitrary file upload vulnerability exists in Kordil EDMS v2.2.60rc3.Check if you run itEPSS 1.67%Aug 5, 2025
- Critical9.4Glossword versions 1.8.8 through 1.8.12 contain an authenticated arbitrary file upload vulnerability.Check if you run itEPSS 1.49%Aug 5, 2025
- Critical10.0The web interface of multiple D-Link routers, including DIR-600 rev B (≤2.14b01) and DIR-300 rev B (≤2.13), contains an unauthenticated OS command injection vulnerability in commanCheck this weekEPSS 16.72%Aug 5, 2025
- Critical9.3An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance version 5.0 - 5.3, 5.4 prior to 5.4.76849, and 5.5 prior to 5.5.Check if you run itEPSS 1.46%Aug 5, 2025
- Medium4.8A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10.Check this weekEPSS 32.00%Aug 5, 2025