Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (44230 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-18062 1 Tecrail 1 Responsive Filemanager 2024-11-21 N/A
An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web script or HTML.
CVE-2018-18035 1 Open-emr 1 Openemr 2024-11-21 N/A
A vulnerability in flashcanvas.swf in OpenEMR before 5.0.1 Patch 6 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
CVE-2018-18029 1 Naviwebs 1 Navigate Cms 2024-11-21 N/A
Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.
CVE-2018-18019 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-slides&method=save Slide[title], Slide[media_file], or Slide[image_url] parameter.
CVE-2018-18017 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
XSS exists in the Tribulant Slideshow Gallery plugin 1.6.8 for WordPress via the wp-admin/admin.php?page=slideshow-galleries&method=save Gallery[id] or Gallery[title] parameter.
CVE-2018-18009 1 Dlink 4 Dir-140l, Dir-140l Firmware, Dir-640l and 1 more 2024-11-21 9.8 Critical
dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials.
CVE-2018-18008 1 Dlink 14 Dir-140l, Dir-140l Firmware, Dir-640l and 11 more 2024-11-21 N/A
spaces.htm on multiple D-Link devices (DSL, DIR, DWR) allows remote unauthenticated attackers to discover admin credentials.
CVE-2018-18007 1 Dlink 2 Dsl-2770l, Dsl-2770l Firmware 2024-11-21 9.8 Critical
atbox.htm on D-Link DSL-2770L devices allows remote unauthenticated attackers to discover admin credentials.
CVE-2018-18006 1 Ricoh 1 Myprint 2024-11-21 N/A
Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.
CVE-2018-18005 1 Vivotek 1 Camera 2024-11-21 N/A
Cross-site scripting in event_script.js in VIVOTEK Network Camera Series products with firmware 0x06x to 0x08x allows remote attackers to execute arbitrary JavaScript via a URL query string parameter.
CVE-2018-17997 1 Layerbb 1 Layerbb 2024-11-21 N/A
LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).
CVE-2018-17989 1 Dlink 2 Dsl-3782, Dsl-3782 Firmware 2024-11-21 N/A
A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when "/cgi-bin/New_GUI/Acl.asp" is requested.
CVE-2018-17981 1 Lifesize 4 Express 220, Express 220 Firmware, Room 220i and 1 more 2024-11-21 6.1 Medium
Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.
CVE-2018-17964 1 Aryanic 1 Highportal 2024-11-21 N/A
Aryanic HighPortal 12.5 has XSS via an Add Tags action.
CVE-2018-17960 1 Ckeditor 1 Ckeditor 2024-11-21 N/A
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVE-2018-17952 1 Microfocus 1 Edirectory 2024-11-21 N/A
Cross site scripting vulnerability in eDirectory prior to 9.1 SP2
CVE-2018-17949 1 Microfocus 1 Imanager 2024-11-21 N/A
Cross site scripting vulnerability in iManager prior to 3.1 SP2.
CVE-2018-17947 1 Atmist 1 Snazzy Maps 2024-11-21 N/A
The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.
CVE-2018-17946 1 Tribulant 1 Slideshow Gallery 2024-11-21 N/A
The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter.
CVE-2018-17919 1 Xiongmaitech 1 Xmeye P2p Cloud Server 2024-11-21 N/A
All versions of Hangzhou Xiongmai Technology Co., Ltd XMeye P2P Cloud Server may allow an attacker to use an undocumented user account "default" with its default password to login to XMeye and access/view video streams.