Show filters
12,168 Total Results
Displaying 11-20 of 10,000
Refine your search criteria for more targeted results.
Sort by:
Attacker Value
Very High
CVE-2021-45837
Disclosure Date: April 25, 2022 (last updated October 07, 2023)
It is possible to execute arbitrary commands as root in Terramaster F4-210, F2-210 TOS 4.2.X (4.2.15-2107141517) by sending a specifically crafted input to /tos/index.php?app/del.
3
Attacker Value
Unknown
CVE-2020-24587
Disclosure Date: May 11, 2021 (last updated November 28, 2024)
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) doesn't require that all fragments of a frame are encrypted under the same key. An adversary can abuse this to decrypt selected fragments when another device sends fragmented frames and the WEP, CCMP, or GCMP encryption key is periodically renewed.
3
Attacker Value
Very High
CVE-2020-25592 — SaltStack Authentication Bypass and Salt SSH Command Execution
Disclosure Date: November 06, 2020 (last updated February 22, 2025)
In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.
4
Attacker Value
Low
CVE-2024-6531
Disclosure Date: July 11, 2024 (last updated July 12, 2024)
A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an <a> tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim's browser.
2
Attacker Value
Very High
CVE-2021-40578
Disclosure Date: December 07, 2021 (last updated October 07, 2023)
Authenticated Blind & Error-based SQL injection vulnerability was discovered in Online Enrollment Management System in PHP and PayPal Free Source Code 1.0, that allows attackers to obtain sensitive information and execute arbitrary SQL commands via IDNO parameter.
3
Attacker Value
Very High
CVE-2021-42169
Disclosure Date: October 22, 2021 (last updated November 28, 2024)
The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypass-Authentication for the admin account. The parameter (username) from the login form is not protected correctly and there is no security and escaping from malicious payloads.
3
Attacker Value
Very High
CVE-2021-41649
Disclosure Date: October 01, 2021 (last updated November 28, 2024)
An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. Using a post request does not sanitize the user input.
3
Attacker Value
Very High
CVE-2021-38833
Disclosure Date: September 13, 2021 (last updated November 28, 2024)
SQL injection vulnerability in PHPGurukul Apartment Visitors Management System (AVMS) v. 1.0 allows attackers to execute arbitrary SQL statements and to gain RCE.
3
Attacker Value
Moderate
CVE-2021-32682
Disclosure Date: June 14, 2021 (last updated November 28, 2024)
elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Several vulnerabilities affect elFinder 2.1.58. These vulnerabilities can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. The issues were patched in version 2.1.59. As a workaround, ensure the connector is not exposed without authentication.
3
Attacker Value
Very High
CVE-2024-22729
Disclosure Date: January 25, 2024 (last updated February 02, 2024)
NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
2
