Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (45365 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2021-25427 1 Google 1 Android 2024-11-21 6.5 Medium
SQL injection vulnerability in Bluetooth prior to SMR July-2021 Release 1 allows unauthorized access to paired device information
CVE-2021-25418 1 Samsung 1 Internet 2024-11-21 7.8 High
Improper component protection vulnerability in Samsung Internet prior to version 14.0.1.62 allows untrusted applications to execute arbitrary activity in specific condition.
CVE-2021-25410 1 Google 1 Android 2024-11-21 7.1 High
Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege.
CVE-2021-25409 1 Google 1 Android 2024-11-21 2.4 Low
Improper access in Notification setting prior to SMR JUN-2021 Release 1 allows physically proximate attackers to set arbitrary notification via physically configuring device.
CVE-2021-25406 1 Samsung 1 Gear S 2024-11-21 6.5 Medium
Information exposure vulnerability in Gear S Plugin prior to version 2.2.05.20122441 allows unstrusted applications to access connected BT device information.
CVE-2021-25356 1 Google 1 Android 2024-11-21 7.1 High
An improper caller check vulnerability in Managed Provisioning prior to SMR APR-2021 Release 1 allows unprivileged application to install arbitrary application, grant device admin permission and then delete several installed application.
CVE-2021-25344 1 Google 1 Android 2024-11-21 6.2 Medium
Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission.
CVE-2021-25213 1 Travel Management System Project 1 Travel Management System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Travel Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the catid parameter to subcat.php.
CVE-2021-25212 1 Alumni Management System Project 1 Alumni Management System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Alumni Management System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to manage_event.php.
CVE-2021-25209 1 Theme Park Ticketing System Project 1 Theme Park Ticketing System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Theme Park Ticketing System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to view_user.php .
CVE-2021-25205 1 E-commerce Website Project 1 E-commerce Website 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester E-Commerce Website V 1.0 allows remote attackers to execute arbitrary SQL statements, via the update parameter to empViewUpdate.php .
CVE-2021-25202 1 Sales And Inventory System Project 1 Sales And Inventory System 2024-11-21 9.8 Critical
SQL injection vulnerability in SourceCodester Sales and Inventory System v 1.0 allows remote attackers to execute arbitrary SQL statements, via the id parameter to \ahira\admin\inventory.php.
CVE-2021-25201 1 Learning Management System Project 1 Learning Management System 2024-11-21 7.5 High
SQL injection vulnerability in Learning Management System v 1.0 allows remote attackers to execute arbitrary SQL statements through the id parameter to obtain sensitive database information.
CVE-2021-25177 2 Opendesign, Siemens 4 Drawings Software Development Kit, Comos, Jt2go and 1 more 2024-11-21 7.8 High
An issue was discovered in Open Design Alliance Drawings SDK before 2021.11. A Type Confusion issue exists when rendering malformed .DXF and .DWG files. This can allow attackers to cause a crash, potentially enabling a denial of service attack (Crash, Exit, or Restart).
CVE-2021-25153 1 Arubanetworks 1 Airwave 2024-11-21 8.1 High
A remote SQL injection vulnerability was discovered in Aruba AirWave Management Platform version(s) prior to 8.2.12.1. Aruba has released patches for AirWave Management Platform that address this security vulnerability.
CVE-2021-25116 1 Enqueue Anything Project 1 Enqueue Anything 2024-11-21 6.5 Medium
The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the remove_asset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put arbitrary posts in the trash.
CVE-2021-25114 1 Strangerstudios 1 Paid Memberships Pro 2024-11-21 9.8 Critical
The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection
CVE-2021-25109 1 Futuriowp 1 Futurio Extra 2024-11-21 2.7 Low
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making send open a malicious link.
CVE-2021-25097 1 Creativityjuice 1 Labtools 2024-11-21 6.5 Medium
The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
CVE-2021-25095 1 Ip2location 1 Country Blocker 2024-11-21 7.1 High
The IP2Location Country Blocker WordPress plugin before 2.26.5 does not have authorisation and CSRF checks in the ip2location_country_blocker_save_rules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend.