Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (4614 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-0648 1 Yunyou Cms Project 1 Yunyou Cms 2026-06-17 7.3 High
A vulnerability has been found in Yunyou CMS up to 2.2.6 and classified as critical. This vulnerability affects unknown code of the file /app/index/controller/Common.php. The manipulation of the argument templateFile leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-251374 is the identifier assigned to this vulnerability.
CVE-2023-5491 1 Byzoro 2 Smart S45f, Smart S45f Firmware 2026-06-17 6.3 Medium
A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This issue affects some unknown processing of the file /sysmanage/updatelib.php. The manipulation of the argument file_upload leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-241643. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2023-50729 1 Traccar 1 Traccar 2026-06-17 8.5 High
Traccar is an open source GPS tracking system. Prior to 5.11, Traccar is affected by an unrestricted file upload vulnerability in File feature allows attackers to execute arbitrary code on the server. This vulnerability is more prevalent because Traccar is recommended to run web servers as root user. It is also more dangerous because it can write or overwrite files in arbitrary locations. Version 5.11 was published to fix this vulnerability.
CVE-2023-40460 1 Sierrawireless 8 Aleos, Es450, Gx450 and 5 more 2026-06-17 7.1 High
The ACEManager component of ALEOS 4.16 and earlier does not validate uploaded file names and types, which could potentially allow an authenticated user to perform client-side script execution within ACEManager, altering the device functionality until the device is restarted.
CVE-2023-29627 1 Online Pizza Ordering Project 1 Online Pizza Ordering 2026-06-17 8.8 High
Online Pizza Ordering v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVE-2023-29621 1 Purchase Order Management Project 1 Purchase Order Management 2026-06-17 8.8 High
Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file uploaded to the server.
CVE-2022-46493 1 Nbnbk Project 1 Nbnbk 2026-06-17 9.8 Critical
Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/download_img.
CVE-2022-45359 1 Yithemes 1 Yith Woocommerce Gift Cards 2026-06-17 9.8 Critical
Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress.
CVE-2022-42698 1 Api2cart 1 Api2cart Bridge Connector 2026-06-17 9.8 Critical
Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.
CVE-2022-42034 1 Wedding Planner Project 1 Wedding Planner 2026-06-17 8.8 High
Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.
CVE-2022-3129 1 Online Driving School Project Project 1 Online Driving School Project 2026-06-17 6.3 Medium
A vulnerability was found in codeprojects Online Driving School. It has been rated as critical. Affected by this issue is some unknown functionality of the file /registration.php. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-207872.
CVE-2022-38140 1 Squirrly 1 Seo Plugin By Squirrly Seo 2026-06-17 7.6 High
Auth. (contributor+) Arbitrary File Upload in SEO Plugin by Squirrly SEO plugin <= 12.1.10 on WordPress.
CVE-2022-2779 1 Gas Agency Management System Project 1 Gas Agency Management System 2026-06-17 6.3 Medium
A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned to this vulnerability.
CVE-2022-2751 1 Company Website Cms Project 1 Company Website Cms 2026-06-17 6.3 Medium
A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/add-portfolio.php. The manipulation of the argument ufile leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-206024.
CVE-2022-2750 1 Company Website Cms Project 1 Company Website Cms 2026-06-17 6.3 Medium
A vulnerability, which was classified as critical, was found in SourceCodester Company Website CMS. Affected is an unknown function of the file /dashboard/add-service.php of the component Add Service Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. VDB-206022 is the identifier assigned to this vulnerability.
CVE-2022-2749 1 Gym Management System Project 1 Gym Management System 2026-06-17 4.7 Medium
A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /mygym/admin/index.php?view_exercises. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206017 was assigned to this vulnerability.
CVE-2022-2746 1 Simple Online Book Store System Project 1 Simple Online Book Store System 2026-06-17 6.3 Medium
A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. This vulnerability affects unknown code of the file Admin_ add.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-206014 is the identifier assigned to this vulnerability.
CVE-2022-2744 1 Gym Management System Project 1 Gym Management System 2026-06-17 6.3 Medium
A vulnerability, which was classified as critical, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality of the file /admin/add_exercises.php of the component Background Management. The manipulation of the argument exer_img leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-206012.
CVE-2022-2740 1 Company Website Cms Project 1 Company Website Cms 2026-06-17 6.3 Medium
A vulnerability was found in SourceCodester Company Website CMS. It has been declared as critical. This vulnerability affects unknown code of the file /dashboard/add-blog.php of the component Add Blog. The manipulation of the argument ufile leads to unrestricted upload. The attack can be initiated remotely. VDB-205882 is the identifier assigned to this vulnerability.
CVE-2022-2736 1 Company Website Cms Project 1 Company Website Cms 2026-06-17 6.3 Medium
A vulnerability was found in SourceCodester Company Website CMS. It has been classified as critical. This affects an unknown part of the file /dashboard/updatelogo.php of the component Background Upload Logo Icon. The manipulation of the argument xfile/ufile leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-205881 was assigned to this vulnerability.