Export limit exceeded: 425898 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 51992 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,992

Export CSV
CVE-2018-20682

Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka "Admin ids" input in the Facebook section).

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fork-cms
Products
Fork Cms
CVE-2018-20663

The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the "Reports > Reports" name field.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Haulmont
Products
Cuba Platform Reporting
CVE-2018-20611

imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Txjia
Products
Imcat
CVE-2018-20601

UCMS 1.4.7 has XSS via the description parameter in an index.php list_editpost action.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ucms Project
Products
Ucms
CVE-2018-20600

sadmin\cedit.php in UCMS 1.4.7 has XSS via an index.php sadmin_cedit action.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ucms Project
Products
Ucms
CVE-2018-20597

UCMS 1.4.7 has XSS via the dir parameter in an index.php sadmin_fileedit action.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ucms Project
Products
Ucms
CVE-2018-20594

An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hsweb
Products
Hsweb
CVE-2018-20583

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).

CVSS 3.0 · 6.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Thephpleague
Products
Commonmark
CVE-2018-20565

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Douco
Products
Douphp