Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44230 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-19092 1 Yzmcms 1 Yzmcms 2024-11-21 N/A
An issue was discovered in YzmCMS v5.2. It has XSS via a search/index/archives/pubtime/ query string, as demonstrated by the search/index/archives/pubtime/1526387722/page/1.html URI. NOTE: this does not obtain a user's cookie.
CVE-2018-19091 1 Tianti Project 1 Tianti 2024-11-21 N/A
tianti 2.3 has reflected XSS in the user management module via the tianti-module-admin/user/list userName parameter.
CVE-2018-19090 1 Tianti Project 1 Tianti 2024-11-21 N/A
tianti 2.3 has stored XSS in the article management module via an article title.
CVE-2018-19089 1 Tianti Project 1 Tianti 2024-11-21 N/A
tianti 2.3 has stored XSS in the userlist module via the tianti-module-admin/user/ajax/save_role name parameter, which is mishandled in tianti-module-admin\src\main\webapp\WEB-INF\views\user\user_list.jsp.
CVE-2018-19083 1 Wecenter 1 Wecenter 2024-11-21 N/A
WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialchars_decode function via the /?/publish/ajax/publish_question/ question_content parameter.
CVE-2018-19080 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS.
CVE-2018-19069 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The CGIProxy.fcgi?cmd=setTelnetSwitch feature is authorized for the root user with a password of toor.
CVE-2018-19067 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. There is a hardcoded Ak47@99 password for the factory~ account.
CVE-2018-19066 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded Pxift* password in some cases.
CVE-2018-19065 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The exported device configuration is encrypted with the hardcoded BpP+2R9*Q password in some cases.
CVE-2018-19063 2 Foscam, Opticam 6 C2, C2 Application Firmware, C2 System Firmware and 3 more 2024-11-21 N/A
An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The admin account has a blank password.
CVE-2018-19057 1 Sparksuite 1 Simplemde 2024-11-21 N/A
SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.
CVE-2018-19056 1 Ipandao 1 Editor.md 2024-11-21 N/A
pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
CVE-2018-19051 1 Metinfo 1 Metinfo 2024-11-21 N/A
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword abt_type parameter.
CVE-2018-19050 1 Metinfo 1 Metinfo 2024-11-21 N/A
MetInfo 6.1.3 has XSS via the admin/index.php?a=dogetpassword langset parameter.
CVE-2018-19048 1 Mycolorway 1 Simditor 2024-11-21 N/A
Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.
CVE-2018-19041 1 Media File Manager Project 1 Media File Manager 2024-11-21 N/A
The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.
CVE-2018-19006 1 Osisoft 1 Pi Vision 2024-11-21 N/A
OSIsoft PI Vision, versions PI Vision 2017, and PI Vision 2017 R2, The application contains a cross-site scripting vulnerability where displays that reference AF elements and attributes containing JavaScript are affected. This vulnerability requires the ability of authorized AF users to store JavaScript in AF elements and attributes.
CVE-2018-1999029 1 Jenkins 1 Shelve Project 2024-11-21 N/A
A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
CVE-2018-1999024 1 Mathjax 1 Mathjax 2024-11-21 N/A
MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.