Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (46632 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2018-14058 1 Pimcore 1 Pimcore 2024-11-21 N/A
Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
CVE-2018-14051 1 Libwav Project 1 Libwav 2024-11-21 N/A
The function wav_read in libwav.c in libwav through 2017-04-20 has an infinite loop.
CVE-2018-14012 1 Wolfsight 1 Wolfsight Cms 2024-11-21 N/A
WolfSight CMS 3.2 allows SQL injection via the PATH_INFO to the default URI.
CVE-2018-13850 1 Icanstudioz 1 Firebase Push Notification On Ios \/ Fcm \+ Advance Admin Panel 2024-11-21 N/A
The "Firebase Cloud Messaging (FCM) + Advance Admin Panel" component supporting Firebase Push Notification on iOS (through 2017-10-26) allows SQL injection via the /advance_push/public/login username parameter.
CVE-2018-13824 2 Broadcom, Ca 2 Project Portfolio Management, Project Portfolio Management 2024-11-21 N/A
Insufficient input sanitization of two parameters in CA PPM 14.3 and below, 14.4, 15.1, 15.2 CP5 and below, and 15.3 CP2 and below, allows remote attackers to execute SQL injection attacks.
CVE-2018-13792 1 Abbyy 1 Flexicapture 2024-11-21 9.8 Critical
Multiple SQL injection vulnerabilities in the monitoring feature in the HTTP API in ABBYY FlexiCapture before 12 Release 2 allow an attacker to execute arbitrary SQL commands via the mask, sortOrder, filter, or Order parameter.
CVE-2018-13450 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 N/A
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the status_batch parameter.
CVE-2018-13449 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 N/A
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut_buy parameter.
CVE-2018-13448 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 N/A
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the country_id parameter.
CVE-2018-13447 1 Dolibarr 1 Dolibarr Erp\/crm 2024-11-21 N/A
SQL injection vulnerability in product/card.php in Dolibarr ERP/CRM version 7.0.3 allows remote attackers to execute arbitrary SQL commands via the statut parameter.
CVE-2018-13442 1 Solarwinds 1 Network Performance Monitor 2024-11-21 N/A
SolarWinds Network Performance Monitor 12.3 allows SQL Injection via the /api/ActiveAlertsOnThisEntity/GetActiveAlerts TriggeringObjectEntityNames parameter.
CVE-2018-13386 1 Atlassian 1 Sourcetree 2024-11-21 N/A
There was an argument injection vulnerability in Sourcetree for Windows via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for Windows before version 2.6.9 are affected by this vulnerability.
CVE-2018-13385 1 Atlassian 1 Sourcetree 2024-11-21 N/A
There was an argument injection vulnerability in Sourcetree for macOS via filenames in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. Versions of Sourcetree for macOS from 1.0b2 before 2.7.6 are affected by this vulnerability.
CVE-2018-13356 1 Terra-master 1 Terramaster Operating System 2024-11-21 N/A
Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user permissions.
CVE-2018-13350 1 Terra-master 1 Terramaster Operating System 2024-11-21 N/A
SQL injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute SQL queries via the "Event" parameter.
CVE-2018-13324 1 Buffalo 2 Ts5600d1206, Ts5600d1206 Firmware 2024-11-21 N/A
Incorrect access control in nasapi in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to bypass authentication by sending a modified HTTP Host header.
CVE-2018-13116 1 Zzcms 1 Zzcms 2024-11-21 N/A
/user/del.php in zzcms 8.3 allows SQL injection via the tablename parameter after leveraging use of the zzcms_ask table.
CVE-2018-13109 1 Adbglobal 8 Dv2210, Dv2210 Firmware, Prg Av4202n and 5 more 2024-11-21 N/A
All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers are able to access and manipulate settings within the web interface that are forbidden to end users (e.g., by the ISP). An attacker would be able to enable the TELNET server or other settings as well.
CVE-2018-13063 1 Easyappointments 1 Easy\!appointments 2024-11-21 7.5 High
Easy!Appointments 1.3.0 has a Missing Authorization issue allowing retrieval of hashed passwords and salts.
CVE-2018-13050 1 Zohocorp 1 Manageengine Applications Manager 2024-11-21 N/A
A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_security_check POST request.