Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8186 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2013-3508 1 Gwos 1 Groundwork Monitor 2025-04-11 N/A
html/System-Files.php in the System File Overview feature in the NeDi component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands via vectors involving file editing.
CVE-2013-3520 1 Vmware 1 Vcenter Chargeback Manager 2025-04-11 N/A
VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2013-3630 1 Moodle 1 Moodle 2025-04-11 N/A
Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
CVE-2013-3631 1 Nas4free 1 Nas4free 2025-04-11 N/A
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
CVE-2013-3651 1 Lockon 1 Ec-cube 2025-04-11 N/A
LOCKON EC-CUBE 2.11.2 through 2.12.4 allows remote attackers to conduct unspecified PHP code-injection attacks via a crafted string, related to data/class/SC_CheckError.php and data/class/SC_FormParam.php.
CVE-2013-3894 1 Microsoft 8 Windows 7, Windows 8, Windows Rt and 5 more 2025-04-11 8.1 High
The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allow remote attackers to execute arbitrary code via a crafted CMAP table in a TrueType font (TTF) file, aka "TrueType Font CMAP Table Vulnerability."
CVE-2013-4172 1 Redhat 3 Cloudforms, Cloudforms Management Engine, Cloudforms Managementengine 2025-04-11 N/A
The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.
CVE-2013-4203 1 Richard Cook 1 Rgpg 2025-04-11 N/A
The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
CVE-2013-4212 1 Apache 1 Roller 2025-04-11 N/A
Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via the first or second parameter, as demonstrated by the pageTitle parameter in the !getPageTitle sub-URL to roller-ui/login.rol, which uses a subclass of UIAction, aka "OGNL Injection."
CVE-2021-38117 2 Microfocus, Opentext 2 Imanager, Imanager 2025-04-10 8.8 High
Possible Command injection Vulnerability in iManager has been discovered in OpenText™ iManager 3.2.4.0000.
CVE-2024-25706 1 Esri 1 Portal For Arcgis 2025-04-10 6.1 Medium
There is an HTML injection vulnerability in Esri Portal for ArcGIS 11.0 and below that may allow a remote, unauthenticated attacker to craft a URL which, when clicked, could potentially generate a message that may entice an unsuspecting victim to visit an arbitrary website. This could simplify phishing attacks.
CVE-2022-4800 1 Usememos 1 Memos 2025-04-10 6.5 Medium
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVE-2024-51298 1 Draytek 2 Vigor3900, Vigor3900 Firmware 2025-04-10 9.8 Critical
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.
CVE-2022-38193 1 Esri 1 Portal For Arcgis 2025-04-10 6.1 Medium
There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.
CVE-2024-3788 1 Whitebearsolutions 1 Wbsairback 2025-04-10 6.6 Medium
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through License (/admin/CDPUsers). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVE-2024-3785 1 Whitebearsolutions 1 Wbsairback 2025-04-10 6.6 Medium
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device NAS shared section (/admin/DeviceNAS). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVE-2024-3786 1 Whitebearsolutions 1 Wbsairback 2025-04-10 6.6 Medium
Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes (SSI), through Device Synchronizations (/admin/DeviceReplication). Exploitation of this vulnerability could allow a remote user to execute arbitrary code.
CVE-2022-25926 1 Window-control Project 1 Window-control 2025-04-10 7.4 High
Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization.
CVE-2024-39932 1 Gogs 1 Gogs 2025-04-10 9.9 Critical
Gogs through 0.13.0 allows argument injection during the previewing of changes.
CVE-2025-25507 1 Tenda 2 Ac6, Ac6 Firmware 2025-04-10 6.5 Medium
There is a RCE vulnerability in Tenda AC6 15.03.05.16_multi. In the formexeCommand function, the parameter cmdinput will cause remote command execution.