Export limit exceeded: 425910 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,910

Export CSV
CVE-2007-2153

Cross-site scripting (XSS) vulnerability in atmail.php in @Mail 5.0 allows remote attackers to inject arbitrary web script or HTML via the username parameter.

CVSS 2.0 · 6.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Atmail
Products
Atmail Webmail
CVE-2007-2155

Directory traversal vulnerability in template.php in in phpFaber TopSites 3 allows remote attackers to read arbitrary files via a .. (dot dot) in the modify parameter in a template action to admin/index.php.

CVSS 2.0 · 7.8 High EPSS 3.0% KEV · Not listed
Vendors
Phpfaber
Products
Topsites
CVE-2007-2157

Directory traversal vulnerability in upload/force_download.php in Zomplog 3.8 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.

CVSS 2.0 · 7.8 High EPSS 3.6% KEV · Not listed
Vendors
Zomplog
Products
Zomplog
CVE-2007-2158

PHP remote file inclusion vulnerability in index.php in jGallery 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the G_JGALL[inc_path] parameter.

CVSS 2.0 · 7.5 High EPSS 2.5% KEV · Not listed
Vendors
Kooijman-design
Products
Jgallery
CVE-2008-4318

Observer 0.3.2.1 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter to (1) whois.php or (2) netcmd.php.

CVSS 2.0 · 10.0 Critical EPSS 14.4% KEV · Not listed
Vendors
Project-observer
Products
Observer
CVE-2008-6536

Unspecified vulnerability in 7-zip before 4.5.7 has unknown impact and remote attack vectors, as demonstrated by the PROTOS GENOME test suite for Archive Formats (c10).

CVSS 2.0 · 10.0 Critical EPSS 2.9% KEV · Not listed
Vendors
7-zip
Products
7-zip
CVE-2008-6546

Unspecified vulnerability in phpns before 2.1.3 has unknown impact and attack vectors related to "activation permissions."

CVSS 2.0 · 10.0 Critical EPSS 1.2% KEV · Not listed
Vendors
Alecwh
Products
Phpns
CVE-2008-6554

cgi-bin/script in Aztech ADSL2/2+ 4-port router 3.7.0 build 070426 allows remote attackers to execute arbitrary commands via shell metacharacters in the query string.

CVSS 2.0 · 10.0 Critical EPSS 3.6% KEV · Not listed
Vendors
Aztech
Products
Adsl2\/2\+4-port Router
CVE-2008-6555

cgi-bin/webutil.pl in The Puppet Master WebUtil allows remote attackers to execute arbitrary commands via shell metacharacters in the dig command.

CVSS 2.0 · 10.0 Critical EPSS 4.5% KEV · Not listed
Vendors
Puppetmaster
Products
Webutil
CVE-2008-6556

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the whois command.

CVSS 2.0 · 10.0 Critical EPSS 3.2% KEV · Not listed
Vendors
Puppet Master
Products
Webutil
CVE-2008-6557

cgi-bin/webutil.pl in The Puppet Master WebUtil 2.7 allows remote attackers to execute arbitrary commands via shell metacharacters in the details command.

CVSS 2.0 · 10.0 Critical EPSS 3.2% KEV · Not listed
Vendors
Puppetmaster
Products
Webutil
CVE-2009-0884

Buffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS packets.

CVSS 2.0 · 4.3 Medium EPSS 4.0% KEV · Not listed
Vendors
Filezilla-project
Products
Filezilla Server
CVE-2009-2273

The default configuration of the Wi-Fi component on the Huawei D100 does not use encryption, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 5.0 Medium EPSS < 1% KEV · Not listed
Vendors
Huawei
Products
D100 D100 Firmware
CVE-2009-3473

IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege for the SET SESSION AUTHORIZATION statement, which has unspecified impact and remote attack vectors.

CVSS 2.0 · 10.0 Critical EPSS 2.1% KEV · Not listed
Vendors
Ibm
Products
Db2
CVE-2006-7021

PHP remote file inclusion vulnerability in manager/tools/link/dbinstall.php in Plume CMS 1.1.3 allows remote attackers to execute arbitrary PHP code via a URL in the _PX_config[manager_path] parameter.

CVSS 2.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Plume-cms
Products
Plume Cms
CVE-2006-4154

Format string vulnerability in the mod_tcl module 1.0 for Apache 2.x allows context-dependent attackers to execute arbitrary code via format string specifiers that are not properly handled in a set_var function call in (1) tcl_cmds.c and (2) tcl_core.c.

CVSS 2.0 · 6.8 Medium EPSS 16.7% KEV · Not listed
Vendors
Apache
Products
Http Server
CVE-2006-5210

Directory traversal vulnerability in IronWebMail before 6.1.1 HotFix-17 allows remote attackers to read arbitrary files via a GET request to the IM_FILE identifier with double-url-encoded "../" sequences ("%252e%252e/").

CVSS 2.0 · 5.0 Medium EPSS 4.4% KEV · Not listed
Vendors
Ciphertrust
Products
Ironmail
CVE-2006-5292

PHP remote file inclusion vulnerability in photo_comment.php in Exhibit Engine 1.5 RC 4 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the toroot parameter.

CVSS 2.0 · 7.5 High EPSS 6.4% KEV · Not listed
Vendors
Exhibit Engine
Products
Exhibit Engine
CVE-2006-7011

PHP remote file inclusion vulnerability in adminips.php in Develooping Flash Chat allows remote attackers to execute arbitrary PHP code via a URL in the banned_file parameter. NOTE: CVE disputes this vulnerability because banned_file is set to a constant value

CVSS 2.0 · 7.5 High EPSS 1.6% KEV · Not listed
Vendors
Develooping
Products
Flash Chat