Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.2The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 0 is improperly categorized as globally routable via isPublic.Check if you run itEPSS 0.12%Sep 16, 2025
- Low3.2The ip (aka node-ip) package through 2.0.1 (in NPM) might allow SSRF because the IP address value 017700000001 is improperly categorized as globally routable via isPublic.Check if you run itEPSS 0.12%Sep 16, 2025
- Critical9.8SQL Injection vulnerability in TDuckCloud v.5.1 allows a remote attacker to execute arbitrary code via the Add a file upload moduleCheck if you run itEPSS 0.82%Sep 16, 2025
- High8.8CYRISMA Sensor before 444 for Windows has an Insecure Folder and File Permissions vulnerability.Check if you run itEPSS 0.59%Sep 16, 2025
- High7.8A DLL hijacking vulnerability in CYRISMA Agent before 444 allows local users to escalate privileges and execute arbitrary code via multiple DLLs.Check if you run itEPSS 0.15%Sep 16, 2025
- Medium5.4A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application.Check if you run itEPSS 0.18%Sep 16, 2025
- Critical9.8An issue in Online Library Management System v.3.0 allows an attacker to escalate privileges via the adminlogin.php component and the Login functionCheck if you run itEPSS 0.56%Sep 16, 2025
- High8.0Edimax BR-6473AX v1.0.28 was discovered to contain a remote code execution (RCE) vulnerability via the Object parameter in the openwrt_getConfig function.Check if you run itEPSS 2.02%Sep 16, 2025
- Medium6.1A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0.Check if you run itEPSS 0.28%Sep 16, 2025
- High7.5An incorrect API discovered in Signify Wiz Connected 1.9.1 allows attackers to remotely launch a DoS on Wiz devices only requiring the MAC address.Check if you run itEPSS 0.33%Sep 16, 2025
- Critical9.1An issue discovered in the Tuya Smart Life App 5.6.1 allows attackers to unprivileged control Matter devices via the Matter protocol.Check if you run itEPSS 0.31%Sep 16, 2025
- High7.3code-projects Computer Laboratory System 1.0 has a file upload vulnerability.Check if you run itEPSS 0.32%Sep 16, 2025
- Medium5.4code-projects Human Resource Integrated System 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section in the Childs Name field.Check if you run itEPSS 0.21%Sep 16, 2025
- Medium5.4code-projects Document Management System 1.0 has a Cross Site Scripting (XSS) vulnerability, where attackers can leak admin's cookie information by entering malicious XSS code in tCheck if you run itEPSS 0.17%Sep 16, 2025
- Medium5.4code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information.Check if you run itEPSS 0.22%Sep 16, 2025
- Medium5.4code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function.Check if you run itEPSS 0.22%Sep 16, 2025
- High7.5The /api/comment endpoint in zhangyd-c OneBlog 2.3.9 contains a denial-of-service vulnerability.Check if you run itEPSS 0.40%Sep 16, 2025
- High8.8by-night sms V1.0 has an Arbitrary File Upload vulnerability.Check if you run itEPSS 0.41%Sep 16, 2025
- Medium6.1A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do componentCheck if you run itEPSS 0.33%Sep 16, 2025
- Critical9.1A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration (ZCS) allows an attacker with valid user credentials to bypass Two-Factor Authentication (2FCheck if you run itEPSS 0.64%Sep 16, 2025
- High7.5In Frappe ERPNext v15.57.5, the function get_stock_balance() at erpnext/stock/utils.py is vulnerable to SQL Injection, which allows an attacker to extract all information from dataCheck if you run itEPSS 0.39%Sep 16, 2025
- High8.0SQL injection vulnerability in oa_system oasys v.1.1 allows a remote attacker to execute arbitrary code via the alph parameters in src/main/Java/cn/gson/oasys/controller/address/AdCheck if you run itEPSS 0.51%Sep 16, 2025
- Low2.2In Alludo MindManager before 25.0.208 on Windows, attackers could potentially execute code as other local users on the same machine if they could write DLL files to directories witCheck if you run itEPSS 0.14%Sep 16, 2025
- Medium5.2A file quarantine bypass was addressed with additional checks.Check if you run itEPSS 0.19%Sep 15, 2025
- High7.8A parsing issue in the handling of directory paths was addressed with improved path validation.Check if you run itEPSS 0.24%Sep 15, 2025
Sort