Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,305

Export CSV
CVE-2025-53836

XWiki Rendering is vulnerable to RCE attacks when processing nested macros

XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Starting in version 4.2-milestone-1 and prior to versions 13.10.11, 14.4.7, and 14.10, the default macro content parser doesn't preserve the restricted attribute of the transformation context when executing nested macros. This allows executing macros that are normally forbidden in restricted mode, in particular script macros. The cache and chart macros that are bundled in XWiki use the vulnerable feature. This has been patched in XWiki 13.10.11, 14.4.7 and 14.10. To avoid the exploitation of this bug, comments can be disabled for untrusted users until an upgrade to a patched version has been performed. Note that users with edit rights will still be able to add comments via the object editor even if comments have been disabled.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Xwiki
Products
Xwiki Xwiki-rendering
CVE-2024-39835

Unsafe use of eval() method in roslaunch tool

A code injection vulnerability has been identified in the Robot Operating System (ROS) 'roslaunch' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() method to process user-supplied, unsanitized parameter values within the substitution args mechanism, which roslaunch evaluates before launching a node. This flaw allows attackers to craft and execute arbitrary Python code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Openrobotics
Products
Robot Operating System
CVE-2024-39289

Unsafe use of eval() method in rosparam tool

A code execution vulnerability has been discovered in the Robot Operating System (ROS) 'rosparam' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability stems from the use of the eval() function to process unsanitized, user-supplied parameter values via special converters for angle representations in radians. This flaw allowed attackers to craft and execute arbitrary Python code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Openrobotics
Products
Robot Operating System
CVE-2024-41148

Unsafe use of eval() method in rostopic hz tool

A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'hz' verb, which reports the publishing rate of a topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Openrobotics
Products
Robot Operating System
CVE-2024-41921

Unsafe use of eval() method in rostopic echo tool

A code injection vulnerability has been discovered in the Robot Operating System (ROS) 'rostopic' command-line tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability lies in the 'echo' verb, which allows a user to introspect a ROS topic and accepts a user-provided Python expression via the --filter option. This input is passed directly to the eval() function without sanitization, allowing a local user to craft and execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Openrobotics
Products
Robot Operating System
CVE-2025-3753

Unsafe use of eval() method in rosbag tool

A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier. The vulnerability arises from the use of the eval() function to process unsanitized, user-supplied input in the 'rosbag filter' command. This flaw enables attackers to craft and execute arbitrary Python code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Openrobotics
Products
Robot Operating System
CVE-2025-7865

thinkgem JeeSite XSS Filter EncodeUtils.java xssFilter cross site scripting

A vulnerability was found in thinkgem JeeSite up to 5.12.0. It has been declared as problematic. This vulnerability affects the function xssFilter of the file src/main/java/com/jeesite/common/codec/EncodeUtils.java of the component XSS Filter. The manipulation of the argument text leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3585737d21fe490ff6948d913fcbd8d99c41fc08. It is recommended to apply a patch to fix this issue.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Jeesite
Products
Jeesite
CVE-2025-9237

CodeAstro Ecommerce Website Edit Your Account my_account.php cross site scripting

A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_account of the component Edit Your Account Page. Performing manipulation of the argument Username results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Codeastro
Products
Ecommerce Website
CVE-2024-13196

donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been declared as problematic. This vulnerability affects the function BookSearchList of the file src/main/java/org/zdd/bookstore/web/controller/BookInfoController.java. The manipulation of the argument keywords leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Donglight
Products
Bookstore
CVE-2024-13197

donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/main/Java/org/zdd/bookstore/web/controller/admin/AdminUserControlle.java. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Donglight
Products
Bookstore
CVE-2025-9306

SourceCodester Advanced School Management System addNotice cross site scripting

A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice/addNotice. The manipulation of the argument noticeSubject results in cross site scripting. It is possible to launch the attack remotely. The exploit is now public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Donbermoy
Products
Advanced School Management System
CVE-2024-13202

wander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scripting

A vulnerability was found in wander-chu SpringBoot-Blog 1.0 and classified as problematic. This issue affects the function modifiyArticle of the file src/main/java/com/my/blog/website/controller/admin/PageController.java of the component Blog Article Handler. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wander-chu
Products
Springboot-blog
CVE-2024-1706

ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting

A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manipulation with the input <marquee>hi causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor explains: "ZKBio Access IVS is no longer maintained and the product has been replaced by ZKBio CVAccess, it is recommended to replace it with the latest version of ZKBio CVAccess." This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Zkteco
Products
Zkbio Access Ivs
CVE-2024-43393

Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devices

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP FW_RULESETS.FROM_IP FW_RULESETS.IN_IP environment variable which can lead to a DoS.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Fl Mguard 2102 Fl Mguard 2102 Firmware Fl Mguard 2105 and 69 more
CVE-2024-43392

Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD devices

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_INCOMING.FROM_IP FW_INCOMING.IN_IP FW_OUTGOING.FROM_IP FW_OUTGOING.IN_IP environment variable which can lead to a DoS.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Fl Mguard Centerport Vpn-1000 Fl Mguard Centerport Vpn-1000 Firmware Fl Mguard Core Tx and 57 more
CVE-2024-43391

Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD devices

A low privileged remote attacker can perform configuration changes of the firewall services, including packet filter, packet forwarding, network access control or NAT through the FW_PORTFORWARDING.SRC_IP environment variable which can lead to a DoS.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Fl Mguard 2102 Fl Mguard 2102 Firmware Fl Mguard 2105 and 69 more
CVE-2024-43390

Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices

A low privileged remote attacker can perform configuration changes of the firewall services, including packet forwarding or NAT through the FW_NAT.IN_IP environment variable which can lead to a DoS.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Fl Mguard 2102 Fl Mguard 2102 Firmware Fl Mguard 2105 and 69 more
CVE-2024-43389

Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devices

A low privileged remote attacker can perform configuration changes of the ospf service through OSPF_INTERFACE.SIMPLE_KEY, OSPF_INTERFACE.DIGEST_KEY environment variables which can lead to a DoS.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Phoenixcontact
Products
Fl Mguard 2102 Fl Mguard 2102 Firmware Fl Mguard 2105 and 69 more