Export limit exceeded: 371127 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 371127 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 371127 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (371127 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2019-25655 3 Ctfer, Hdd, Hhdsoftware 3 Monitoring, Device Monitoring Studio, Device Monitoring Studio 2026-07-28 6.2 Medium
Device Monitoring Studio 8.10.00.8925 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the server connection dialog. Attackers can trigger the crash by entering a malformed server name or address containing repeated characters through the Tools menu Connect to New Server interface.
CVE-2019-25614 2 Freefloat, Freefloat Ftp Server Project 2 Freefloat Ftp Server, Freefloat Ftp Server 2026-07-28 9.8 Critical
Free Float FTP 1.0 contains a buffer overflow vulnerability in the STOR command handler that allows remote attackers to execute arbitrary code by sending a crafted STOR request with an oversized payload. Attackers can authenticate with anonymous credentials and send a malicious STOR command containing 247 bytes of padding followed by a return address and shellcode to trigger code execution on the FTP server.
CVE-2019-25612 2 Admin-express, Express 2 Admin-express, Express 2026-07-28 7.8 High
Admin Express 1.2.5.485 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an alphanumeric encoded payload in the Folder Path field. Attackers can trigger the vulnerability through the System Compare feature by pasting a crafted buffer overflow payload into the left-hand side Folder Path field and clicking the scale icon to execute shellcode with application privileges.
CVE-2019-25502 2 Niteosoft, Simplejobscript 2 Simple Job Script, Simplejobscript 2026-07-28 6.1 Medium
Simple Job Script contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the job_type_value parameter in the jobs endpoint. Attackers can craft requests with SVG payload injection to execute arbitrary JavaScript in victim browsers and steal session cookies or perform unauthorized actions.
CVE-2019-25501 2 Niteosoft, Simplejobscript 2 Simple Job Script, Simplejobscript 2026-07-28 8.2 High
Simple Job Script contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code through the app_id parameter. Attackers can send POST requests to delete_application_ajax.php with crafted payloads to extract sensitive data, bypass authentication, or modify database contents.
CVE-2019-25500 2 Niteosoft, Simplejobscript 2 Simple Job Script, Simplejobscript 2026-07-28 8.2 High
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the employerid parameter. Attackers can send POST requests to the register-recruiters endpoint with time-based SQL injection payloads to extract sensitive data or modify database contents.
CVE-2019-25499 2 Niteosoft, Simplejobscript 2 Simple Job Script, Simplejobscript 2026-07-28 8.2 High
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the job_id parameter. Attackers can send POST requests to get_job_applications_ajax.php with malicious job_id values to bypass authentication, extract sensitive data, or modify database contents.
CVE-2019-25498 2 Niteosoft, Simplejobscript 2 Simple Job Script, Simplejobscript 2026-07-28 8.2 High
Simple Job Script contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the landing_location parameter. Attackers can send POST requests to the searched endpoint with malicious SQL payloads to bypass authentication and extract sensitive database information.
CVE-2019-25479 2 Inoutscripts, Realestate Project 2 Inout Realestate, Realestate 2026-07-28 8.2 High
Inout RealEstate contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the city parameter. Attackers can send POST requests to the agents/agentlistdetails endpoint with malicious SQL payloads in the city parameter to extract sensitive database information.
CVE-2019-25434 1 Nsasoft 2 Nsauditor Spotauditor, Spotauditor 2026-07-28 7.5 High
SpotAuditor 5.3.1.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting excessive data in the registration name field. Attackers can enter a large string of characters (5000 bytes or more) in the name field during registration to trigger an unhandled exception that crashes the application.
CVE-2019-25285 2 Alps, Aviatrix 2 Pointing-device Controller, Controller 2026-07-28 7.8 High
Alps Pointing-device Controller 8.1202.1711.04 contains an unquoted service path vulnerability in the ApHidMonitorService that allows local attackers to execute code with elevated privileges. Attackers can place a malicious executable in the service path and gain system-level access when the service restarts or the system reboots.
CVE-2019-25256 1 Avg 1 Protection 2026-07-28 6.5 Medium
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers to access arbitrary system files through unvalidated 'ID' parameters. Attackers can exploit multiple Perl scripts like downloadsys.pl to read sensitive files by manipulating directory path traversal in download requests.
CVE-2019-25255 1 Avg 1 Protection 2026-07-28 4.3 Medium
VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows attackers to execute system commands with root privileges. Attackers can exploit the vulnerability through a cross-site request forgery (CSRF) mechanism to gain unauthorized system access.
CVE-2019-25233 1 Ave 1 Dominaplus 2026-07-28 5.3 Medium
AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser sessions.
CVE-2018-25437 3 Basticom, Cherryframework, Wordpress 3 Framework, Cherry Framework Themes, Wordpress 2026-07-28 7.5 High
WordPress CherryFramework Themes 3.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to download sensitive backup files by accessing the download_backup.php endpoint. Attackers can directly access the download_backup.php script in the admin/data_management directory to obtain ZIP archives containing the entire wp-content/themes directory contents.
CVE-2018-25431 2 Gofrendiasgard, No-cms Project 2 No-cms, No-cms 2026-07-28 7.1 High
No-Cms 1.0 contains an SQL injection vulnerability in the order_by parameter of the manage_privilege export endpoint that allows authenticated attackers to manipulate database queries. Attackers can submit POST requests to /nocms/main/manage_privilege/index/export with malicious SQL code in the order_by[0] parameter to extract sensitive database information.
CVE-2018-25396 2 Heatmiser, Redhat 2 Heatmiser Wifi Thermostat, Thermostat 2026-07-28 7.5 High
Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networkSetup.htm page. Attackers can request the networkSetup.htm endpoint and extract plaintext username and password values from HTML form fields to gain administrative access to the thermostat.
CVE-2018-25377 1 Socusoft 1 Flash Slideshow Maker 2026-07-28 8.4 High
Flash Slideshow Maker Professional 5.20 contains a buffer overflow vulnerability in the registration dialog that allows local attackers to execute arbitrary code by exploiting structured exception handling. Attackers can craft a malicious payload and paste it into the Name and Code fields of the Help > Register dialog to trigger a reverse shell with system privileges.
CVE-2018-25372 1 Meddream 2 Pacs Premium, Pacs Server 2026-07-28 8.2 High
MedDream PACS Server Premium 6.7.1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the email parameter. Attackers can submit crafted POST requests to the userSignup.php endpoint with SQL payloads in the email field to extract sensitive database information from the backend MySQL database.
CVE-2018-25359 1 Splinterware 2 Splinterware System Scheduler Pro, System Scheduler 2026-07-28 8.4 High
Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying service executable files. Attackers can rename the WService.exe file in the installation directory and replace it with a malicious executable that executes with LocalSystem privileges when the service is triggered.