Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.41%Apr 14, 2026
- Medium5.1October is a Content Management System (CMS) and web platform.Check if you run itEPSS 0.20%Apr 14, 2026
- Medium5.1October is a Content Management System (CMS) and web platform.Check if you run itEPSS 0.25%Apr 14, 2026
- Medium6.9Under certain administrative conditions, FlashArray Purity may apply snapshot retention policies earlier or later than configured.Check if you run itEPSS 0.38%Apr 14, 2026
- Medium6.8October is a Content Management System (CMS) and web platform.Check if you run itEPSS 0.40%Apr 14, 2026
- Medium6.5An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify s…Check if you run itEPSS 0.50%Apr 14, 2026
- Critical9.9An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via u…Check if you run itEPSS 2.35%Apr 14, 2026
- Medium5.3CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user…Check if you run itEPSS 0.24%Apr 14, 2026
- Medium5.3CWE-1284 Improper Validation of Specified Quantity in Input vulnerability exists that could cause Event and Data Log truncation impacting log integrity when a Web Admi…Check if you run itEPSS 0.17%Apr 14, 2026
- Low2.4CWE-532 Insertion of Sensitive Information into Log File vulnerability exists that could cause confidential information to be exposed when a Web Admin user executes a…Check if you run itEPSS 0.10%Apr 14, 2026
- Medium5.3CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') vulnerability exists that could cause application user credentials to reset when a Web Admin user a…Check if you run itEPSS 0.23%Apr 14, 2026
- Medium6.9CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause critical files overwritten with text data w…Check if you run itEPSS 0.20%Apr 14, 2026
- Low2.7A insufficiently protected credentials vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, FortiSandbox PaaS 5.0.1 through 5.0.5…Check if you run itEPSS 0.30%Apr 14, 2026
- Medium6.7A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through…Check if you run itEPSS 0.47%Apr 14, 2026
- Medium4.8An URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, F…Check if you run itEPSS 0.21%Apr 14, 2026
- Medium6.1In manikandan580 School-management-system 1.0, a reflected XSS vulnerability exists in /studentms/admin/contact-us.php via the pagedes POST parameter.Check if you run itEPSS 0.18%Apr 14, 2026
- Critical9.8In manikandan580 School-management-system 1.0, a time-based blind SQL injection vulnerability exists in /studentms/admin/between-date-reprtsdetails.php through the fro…Check if you run itEPSS 0.29%Apr 14, 2026
- Medium6.1In manikandan580 School-management-system 1.0, a reflected cross-site scripting (XSS) vulnerability exists in /studentms/admin/contact-us.php via the email POST parameter.Check if you run itEPSS 0.18%Apr 14, 2026
- Medium6.1alandsilva26 hotel-management-php 1.0 is vulnerable to Cross Site Scripting (XSS) in /public/admin/edit_room.php which allows an attacker to inject and execute arbitra…Check if you run itEPSS 0.18%Apr 14, 2026
- Medium6.5Fortinet Multiple Products Path Traversal VulnerabilityPatch nowKEVEPSS 1.08%Apr 14, 2026
- Medium4.8A flaw was found in Keycloak, specifically in the organization selection login page.Check if you run itEPSS 0.38%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/user/manage_user.php.Check if you run itEPSS 0.31%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/manage_appointment.php.Check if you run itEPSS 0.31%Apr 14, 2026
- Low2.7SourceCodester Patient Appointment Scheduler System v1.0 is vulnerable to SQL Injection in the file /scheduler/admin/appointments/view_details.php.Check if you run itEPSS 0.31%Apr 14, 2026
- Low2.7SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfh_attendance/admin/attendance_list.php.Check if you run itEPSS 0.31%Apr 14, 2026