Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (46006 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2017-9306 1 Syspass 1 Syspass 2025-04-20 N/A
inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter, as demonstrated by use of an "<svg/onload=" substring instead of an "<svg onload=" substring.
CVE-2017-2280 1 Iodata 2 Wn-ax1167gr, Wn-ax1167gr Firmware 2025-04-20 N/A
WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.
CVE-2017-9332 1 Pivotx 1 Pivotx 2025-04-20 N/A
The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the self Smarty tag.
CVE-2017-9336 1 Wp Editor.md Project 1 Wp Editor.md 2025-04-20 N/A
The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.
CVE-2017-9337 1 Markdown On Save Improved Project 1 Markdown On Save Improved 2025-04-20 N/A
The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.
CVE-2017-11744 1 Modx 1 Modx Revolution 2025-04-20 N/A
In MODX Revolution 2.5.7, the "key" and "name" parameters in the System Settings module are vulnerable to XSS. A malicious payload sent to connectors/index.php will be triggered by every user, when they visit this module.
CVE-2017-5490 1 Wordpress 1 Wordpress 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to wp-admin/includes/class-theme-installer-skin.php.
CVE-2017-6394 1 Open-emr 1 Openemr 2025-04-20 6.1 Medium
Multiple Cross-Site Scripting (XSS) issues were discovered in OpenEMR 5.0.0 and 5.0.1-dev. The vulnerabilities exist due to insufficient filtration of user-supplied data passed to the "openemr-master/gacl/admin/object_search.php" URL (section_value; src_form). An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVE-2017-9931 1 Greenpacket 2 Dx-350, Dx-350 Firmware 2025-04-20 N/A
Cross-Site Scripting (XSS) exists in Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb, as demonstrated by the action parameter to ajax.cgi.
CVE-2017-5494 1 B2evolution 1 B2evolution 2025-04-20 N/A
Multiple cross-site scripting (XSS) vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a (1) comment frame or (2) avatar frame.
CVE-2017-6392 1 Kaltura 1 Kaltura Server 2025-04-20 N/A
An issue was discovered in Kaltura server Lynx-12.11.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the "server-Lynx-12.11.0/admin_console/web/tools/XmlJWPlayer.php" URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
CVE-2017-2307 1 Juniper 1 Junos Space 2025-04-20 N/A
A reflected cross site scripting vulnerability in the administrative interface of Juniper Networks Junos Space versions prior to 16.1R1 may allow remote attackers to steal sensitive information or perform certain administrative actions on Junos Space.
CVE-2017-15380 1 Softwarepublico 1 E-sic 2025-04-20 N/A
XSS exists in the E-Sic 1.0 /cadastro/index.php URI (aka the requester's registration area) via the nome parameter.
CVE-2017-1000078 1 Onosproject 1 Onos 2025-04-20 6.1 Medium
Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration
CVE-2017-1000063 1 Kitto Project 1 Kitto 2025-04-20 N/A
kittoframework kitto version 0.5.1 is vulnerable to an XSS in the 404 page resulting in information disclosure
CVE-2016-6113 1 Ibm 2 Domino, Inotes 2025-04-20 N/A
IBM Verse is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2015-8862 1 Mustache.js Project 1 Mustache.js 2025-04-20 N/A
mustache package before 2.2.1 for Node.js allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging a template with an attribute that is not quoted.
CVE-2017-15384 1 Phpjabbers 1 Rate Me 2025-04-20 N/A
rate-me.php in Rate Me 1.0 has XSS via the id field in a rate action.
CVE-2017-11777 1 Microsoft 1 Sharepoint Enterprise Server 2025-04-20 N/A
Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11775 and CVE-2017-11820.
CVE-2017-5515 1 Metalgenix 1 Genixcms 2025-04-20 N/A
Cross-site scripting (XSS) vulnerability in the user prompt function in GeniXCMS through 0.0.8 allows remote authenticated users to inject arbitrary web script or HTML via tag names.