Export limit exceeded: 51989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,989

Export CSV
CVE-2018-16773

EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Easycms
Products
Easycms
CVE-2018-16772

Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Hoosk
Products
Hoosk
CVE-2018-16759

The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Easycms
Products
Easycms
CVE-2018-16736

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).

CVSS 3.0 · 5.4 Medium EPSS 2.6% KEV · Not listed
Vendors
Rcfilters Project
Products
Rcfilters
CVE-2018-16730

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Chshcms
Products
Cscms
CVE-2018-16729

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pluck-cms
Products
Pluck
CVE-2018-16728

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Feindura
Products
Feindura
CVE-2018-16727

razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Razorcms
Products
Razorcms
CVE-2018-16726

razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Razorcms
Products
Razorcms
CVE-2018-16725

An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Baijiacms Project
Products
Baijiacms
CVE-2018-16718

An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nih
Products
Ncbi Toolbox
CVE-2018-16655

Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gxlcms
Products
Gxlcms
CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Zurmo
Products
Zurmo Crm
CVE-2018-16637

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Modx
Products
Evolution Cms
CVE-2018-16635

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Blackcat-cms
Products
Blackcat Cms
CVE-2018-16633

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Pluck-cms
Products
Pluck