Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.3Zohocorp ManageEngine ADAudit Plus versions below 8511 are vulnerable to SQL injection while exporting reports.Check this weekEPSS 38.28%May 23, 2025
- Critical9.1Token used for resetting passwords in MegaBIP software are generated using a small space of random values combined with a queryable value.Check if you run itEPSS 0.51%May 23, 2025
- Medium4.8Text editor embedded into MegaBIP software does not neutralize user input allowing Stored XSS attacks on other users.Check if you run itEPSS 0.45%May 23, 2025
- High8.6While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action.Check if you run itEPSS 0.41%May 23, 2025
- Medium5.1DobryCMS in versions 2.* and lower is vulnerable to Reflected Cross-Site Scripting (XSS).Check if you run itEPSS 0.50%May 23, 2025
- High8.4Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data if administrator credentials become compromised.Check if you run itEPSS 0.43%May 23, 2025
- Medium6.9The optional feature 'Anti-Virus & Sandbox' of i-FILTER contains an issue with improper pattern file validation.Check if you run itEPSS 0.17%May 23, 2025
- Medium6.4The Tournamatch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trn-ladder-registration-button' shortcode in all versions up to, and including,Check if you run itEPSS 0.28%May 23, 2025
- High8.0A double-free condition occurs during the cleanup of temporary image files, which can be exploited to achieve memory corruption and potentially arbitrary code execution.Check if you run itEPSS 0.26%May 23, 2025
- Critical9.1PrinterShare Android application allows the capture of Gmail authentication tokens that can be reused to access a user's Gmail account without proper authorization.Check if you run itEPSS 0.31%May 23, 2025
- Critical9.8An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution.Check if you run itEPSS 0.74%May 23, 2025
- None0.0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Open the advisoryMay 23, 2025
- None0.0Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Open the advisoryMay 23, 2025
- Medium4.7Ecovacs Home Android and iOS Mobile Applications up to version 3.3.0 contained embedded access keys and secrets for Alibaba Object Storage Service (OSS), leading to sensitive dataCheck if you run itEPSS 0.21%May 23, 2025
- Medium6.8A Broken Access Control vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, and 5.4.0 before 5.4.10 allows remote, authenticated, and unprivileged users tCheck if you run itEPSS 0.33%May 23, 2025
- Medium5.9A Cross-Site Request Forgery (CSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows a remote attackCheck if you run itEPSS 0.27%May 23, 2025
- Medium4.6A Server-Side Request Forgery (SSRF) vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows remote authentCheck if you run itEPSS 0.43%May 23, 2025
- Medium6.9An e-mail flooding vulnerability in StrangeBee TheHive 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1 allows unauthenticated remote attackersCheck if you run itEPSS 0.53%May 23, 2025
- Medium4.3A SQL Injection issue in the request body processing in BOS IPCs with firmware 21.45.8.2.2_220219 before 21.45.8.2.3_230220 allows remote attackers to obtain sensitive informationCheck if you run itEPSS 0.34%May 23, 2025
- Medium4.0gs_lib_ctx_stash_sanitized_arg in base/gslibctx.c in Artifex Ghostscript before 10.05.1 lacks argument sanitization for the # case.Check if you run itEPSS 0.32%May 23, 2025
- Medium5.4openDCIM through 23.04 allows SQL injection in people_depts.php because prepared statements are not used.Check if you run itEPSS 0.24%May 23, 2025
- Medium6.4An issue was discovered in CyberDAVA before 1.1.20.Check if you run itEPSS 0.22%May 23, 2025
- Medium6.5Hardcoded credentials in the Telnet service in D-Link DIR-605L v2.13B01 and DIR-816L v2.06B01 allow attackers to remotely execute arbitrary commands via firmware analysis.Check if you run itEPSS 0.39%May 23, 2025
- Medium6.1A stored cross-site scripting (XSS) vulnerability in the component /tinyfilemanager.php of TinyFileManager v2.4.7 allows attackers to execute arbitrary JavaScript or HTML via injecCheck if you run itEPSS 0.29%May 23, 2025
- Critical9.8An issue in Hospital Management System In PHP V4.0 allows a remote attacker to execute arbitrary code via the hms/doctor/edit-profile.php fileCheck if you run itEPSS 0.99%May 23, 2025
Sort