Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (4034 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2014-8337 1 Helpdezk 1 Helpdezk 2024-11-21 9.8 Critical
Unrestricted file upload vulnerability in includes/classes/uploadify-v2.1.4/uploadify.php in HelpDEZk 1.0.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the directory specified by the folder parameter.
CVE-2014-4972 1 Ajax Upload For Gravity Forms Project 1 Ajax Upload For Gravity Forms 2024-11-21 N/A
Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravity_forms.
CVE-2014-4912 1 Frog Cms Project 1 Frog Cms 2024-11-21 N/A
An Arbitrary File Upload issue was discovered in Frog CMS 0.9.5 due to lack of extension validation.
CVE-2014-3448 1 Bss Continuity Cms Project 1 Bss Continuty Cms 2024-11-21 9.8 Critical
BSS Continuity CMS 4.2.22640.0 has a Remote Code Execution vulnerability due to unauthenticated file upload
CVE-2014-2592 1 Arubanetworks 1 Web Management Portal 2024-11-21 N/A
Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
CVE-2014-2025 1 Unitedplanet 1 Intrexx 2024-11-21 9.8 Critical
Unrestricted file upload vulnerability in an unspecified third party tool in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via unknown vectors.
CVE-2014-1214 1 Projoom 1 Smart Flash Header 2024-11-21 8.8 High
views/upload.php in the ProJoom Smart Flash Header (NovaSFH) component 3.0.2 and earlier for Joomla! allows remote attackers to upload and execute arbitrary files via a crafted (1) dest parameter and (2) arbitrary extension in the Filename parameter.
CVE-2014-10074 1 Umbraco 1 Umbraco Cms 2024-11-21 N/A
Umbraco before 7.2.0 has a remote PHP code execution vulnerability because Umbraco.Web.UI/config/umbracoSettings.Release.config does not block the upload of .php files.
CVE-2013-6234 1 Eng 1 Spagobi 2024-11-21 8.0 High
Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, aka "XSS File Upload."
CVE-2013-3684 1 Imagely 1 Nextgen Gallery 2024-11-21 9.8 Critical
NextGEN Gallery plugin before 1.9.13 for WordPress: ngggallery.php file upload
CVE-2013-3591 1 Vtiger 1 Vtiger Crm 2024-11-21 8.8 High
vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability
CVE-2013-2748 1 Belkin 2 Wemo Switch, Wemo Switch Firmware 2024-11-21 9.8 Critical
Belkin Wemo Switch before WeMo_US_2.00.2176.PVT could allow remote attackers to upload arbitrary files onto the system.
CVE-2013-2057 1 Yabb 1 Yabb 2024-11-21 9.8 Critical
YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability
CVE-2013-20002 1 Themify 1 Framework 2024-11-21 9.8 Critical
Elemin allows remote attackers to upload and execute arbitrary PHP code via the Themify framework (before 1.2.2) wp-content/themes/elemin/themify/themify-ajax.php file.
CVE-2013-1916 1 User Photo Project 1 User Photo 2024-11-21 8.8 High
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
CVE-2013-0803 1 Polarbear Cms Project 1 Polarbear Cms 2024-11-21 9.8 Critical
A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php, which could let a malicious user execute arbitrary code.
CVE-2012-1592 1 Apache 1 Struts 2024-11-21 8.8 High
A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2010-4661 5 Debian, Fedoraproject, Opensuse and 2 more 5 Debian Linux, Fedora, Opensuse and 2 more 2024-11-21 7.8 High
udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.
CVE-2010-3663 1 Typo3 1 Typo3 2024-11-21 8.8 High
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote attackers to execute arbitrary code on the backend.
CVE-2024-52429 2 Anton Hoelstad, Antonhoelstad 2 Wp Quick Setup, Wp Quick Setup 2024-11-20 9.9 Critical
Unrestricted Upload of File with Dangerous Type vulnerability in Anton Hoelstad WP Quick Setup allows Upload a Web Shell to a Web Server.This issue affects WP Quick Setup: from n/a through 2.0.