Threat database

739 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Medium	5.4	EPSS 0.4%	CVE-2024-22548n/a · n/a Medium5.4EPSS 0.4%2024-01-18CVE Database V5CVE-2024-22548 FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section. EPSS 0.4%Vulnerability	CVE Database V5	2024-01-18
High	8.8	EPSS 0.4%	CVE-2024-22699n/a · n/a High8.8EPSS 0.4%2024-01-18CVE Database V5CVE-2024-22699 FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update_group_save. EPSS 0.4%Vulnerability	CVE Database V5	2024-01-18
High	8.8	EPSS 0.3%	CVE-2024-22817n/a · n/a High8.8EPSS 0.3%2024-01-18CVE Database V5CVE-2024-22817 FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_conf_updagte EPSS 0.3%Vulnerability	CVE Database V5	2024-01-18
High	8.8	EPSS 0.3%	CVE-2024-22819n/a · n/a High8.8EPSS 0.3%2024-01-18CVE Database V5CVE-2024-22819 FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email_templets_update. EPSS 0.3%Vulnerability	CVE Database V5	2024-01-18
High	8.8	EPSS 0.3%	CVE-2024-22592n/a · n/a High8.8EPSS 0.3%2024-01-18CVE Database V5CVE-2024-22592 FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group_update EPSS 0.3%Vulnerability	CVE Database V5	2024-01-18
High	8.8	EPSS 1.2%	CVE-2023-51217n/a · n/a High8.8EPSS 1.2%2024-01-18CVE Database V5CVE-2023-51217 An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitrary code via crafted command on the ping page component. EPSS 1.2%Vulnerability	CVE Database V5	2024-01-18
High	7.5	EPSS 0.4%	CVE-2023-50614n/a · n/a High7.5EPSS 0.4%2024-01-18CVE Database V5CVE-2023-50614 An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. EPSS 0.4%Vulnerability	CVE Database V5	2024-01-18
Medium	5.4	EPSS 1.8%	CVE-2023-49943n/a · n/a Medium5.4EPSS 1.8%2024-01-18CVE Database V5CVE-2023-49943 Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet. EPSS 1.8%Vulnerability	CVE Database V5	2024-01-18
Medium	6.5	EPSS 0.7%	CVE-2023-36235n/a · n/a Medium6.5EPSS 0.7%2024-01-17CVE Database V5CVE-2023-36235 An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter. EPSS 0.7%Vulnerability	CVE Database V5	2024-01-17
Medium	6.5	EPSS 0.8%	CVE-2024-23525n/a · n/a Medium6.5EPSS 0.8%2024-01-17CVE Database V5CVE-2024-23525 The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig. EPSS 0.8%Vulnerability	CVE Database V5	2024-01-17
Medium	5.4	EPSS 0.3%	CVE-2023-52069n/a · n/a Medium5.4EPSS 0.3%2024-01-17CVE Database V5CVE-2023-52069 kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. EPSS 0.3%Vulnerability	CVE Database V5	2024-01-17
Medium	6.1	EPSS 0.5%	CVE-2023-48858n/a · n/a Medium6.1EPSS 0.5%2024-01-17CVE Database V5CVE-2023-48858 A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part. EPSS 0.5%Vulnerability	CVE Database V5	2024-01-17
Medium	6.1	EPSS 0.5%	CVE-2023-46952n/a · n/a Medium6.1EPSS 0.5%2024-01-17CVE Database V5CVE-2023-46952 Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer header. EPSS 0.5%Vulnerability	CVE Database V5	2024-01-17
High	7.3	EPSS 0.9%	CVE-2024-0603ZhiCms · Deserialization High7.3EPSS 0.9%2024-01-16CVE Database V5CVE-2024-0603 A vulnerability classified as critical has been found in ZhiCms up to 4.0. This affects an unknown part of the file app/plug/controller/giftcontroller.php. The manipulation of the argument mylike leads to deserialization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-250839. EPSS 0.9%Vulnerability n/a #cwe-502	CVE Database V5	2024-01-16
Medium	6.3	EPSS 3.5%	CVE-2011-10005EasyFTP · Buffer Overflow Medium6.3EPSS 3.5%2024-01-16CVE Database V5CVE-2011-10005 A vulnerability, which was classified as critical, was found in EasyFTP 1.7.0.2. Affected is an unknown function of the component MKD Command Handler. The manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250716. EPSS 3.5%Vulnerability n/a #cwe-120	CVE Database V5	2024-01-16
Medium	5.4	EPSS 0.4%	CVE-2024-22491n/a · n/a Medium5.4EPSS 0.4%2024-01-16CVE Database V5CVE-2024-22491 A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameter. EPSS 0.4%Vulnerability	CVE Database V5	2024-01-16
High	7.2	EPSS 0.7%	CVE-2024-22625n/a · n/a High7.2EPSS 0.7%2024-01-16CVE Database V5CVE-2024-22625 Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_category.php?id=. EPSS 0.7%Vulnerability	CVE Database V5	2024-01-16
High	7.2	EPSS 0.7%	CVE-2024-22626n/a · n/a High7.2EPSS 0.7%2024-01-16CVE Database V5CVE-2024-22626 Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_retailer.php?id=. EPSS 0.7%Vulnerability	CVE Database V5	2024-01-16
High	8.8	EPSS 0.9%	CVE-2023-51059n/a · n/a High8.8EPSS 0.9%2024-01-16CVE Database V5CVE-2023-51059 An issue in MOKO TECHNOLOGY LTD MOKOSmart MKGW1 BLE Gateway v.1.1.1 and before allows a remote attacker to escalate privileges via the session management component of the administrative web interface. EPSS 0.9%Vulnerability	CVE Database V5	2024-01-16
High	8.8	EPSS 1.2%	CVE-2023-47460n/a · n/a High8.8EPSS 1.2%2024-01-16CVE Database V5CVE-2023-47460 SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Service/Admin.svc/getGridColumnStructure component. EPSS 1.2%Vulnerability	CVE Database V5	2024-01-16

Showing 281–300 of 739 results