Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811.Check if you run itEPSS 0.52%Apr 15, 2025
- Medium6.1In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability.Check if you run itEPSS 0.29%Apr 15, 2025
- Medium6.1In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability.Check if you run itEPSS 0.29%Apr 15, 2025
- Medium4.0In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed.Check if you run itEPSS 0.47%Apr 15, 2025
- Medium4.0In http-proxy-middleware before 2.0.8 and 3.x before 3.0.4, writeBody can be called twice because "else if" is not used.Check if you run itEPSS 0.47%Apr 15, 2025
- Medium6.5Vision Helpdesk through 5.7.0 allows Time-Based Blind SQL injection via the Forgot Password (aka index.php?/home/forgot-password) vis_username parameter.Check if you run itEPSS 0.28%Apr 15, 2025
- Medium6.0Arctera eDiscovery Platform before 10.3.2, when Enterprise Vault Collection Module is used, places a cleartext password on a command line in EVSearcher.Check if you run itEPSS 0.17%Apr 15, 2025
- Medium5.0CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at UNC share pathnames,Check this weekEPSS 18.09%Apr 15, 2025
- Medium4.3code-gen <=2.0.6 is vulnerable to Incorrect Access Control.Check if you run itEPSS 0.32%Apr 15, 2025
- High8.3Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field.Check if you run itEPSS 7.28%Apr 15, 2025
- High8.8In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute code within them.Check if you run itEPSS 0.77%Apr 15, 2025
- Medium4.8Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker to insert and executeCheck if you run itEPSS 0.27%Apr 15, 2025
- Medium5.5A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file.Check if you run itEPSS 0.36%Apr 15, 2025
- Critical9.8An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class.Check if you run itEPSS 0.62%Apr 15, 2025
- Medium5.9A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.Check if you run itEPSS 0.28%Apr 15, 2025
- Medium6.5Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDiskFormat.Check if you run itEPSS 9.82%Apr 15, 2025
- Medium6.5Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc function.Check if you run itEPSS 5.13%Apr 15, 2025
- Medium6.5Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/formDiskCreateGroup.Check if you run itEPSS 9.47%Apr 15, 2025
- Medium6.5Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/formDiskCreateShare.Check if you run itEPSS 9.82%Apr 15, 2025
- Critical9.8TOTOLINK a810r_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 34.09%Apr 15, 2025
- Medium6.5TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi.Check if you run itEPSS 0.31%Apr 15, 2025
- Critical9.8A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter.Check if you run itEPSS 0.65%Apr 15, 2025
- Medium6.5cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=.Check if you run itEPSS 0.33%Apr 15, 2025
- Medium6.8Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint.Check this weekEPSS 12.93%Apr 15, 2025
- Medium4.6Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via serverName2.Check if you run itEPSS 0.26%Apr 15, 2025
Sort