Export limit exceeded: 372547 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 372547 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372547 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-69942 | 1 Campcodes | 1 Hospital Management System | 2026-08-02 | 9.8 Critical |
| kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. | ||||
| CVE-2025-51684 | 1 Clevertap | 1 Web Sdk | 2026-08-02 | 6.1 Medium |
| CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site. | ||||
| CVE-2026-35847 | 2026-08-02 | 9.8 Critical | ||
| An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file | ||||
| CVE-2025-65336 | 2026-08-02 | 9.8 Critical | ||
| Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. | ||||
| CVE-2025-69936 | 2026-08-02 | 9.8 Critical | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | ||||
| CVE-2026-16292 | 2 Frontend File Manager Plugin, Wordpress | 2 Frontend File Manager Plugin, Wordpress | 2026-08-02 | N/A |
| The Frontend File Manager Plugin WordPress plugin through 23.6 does not perform nonce validation on one of its file-metadata update actions, allowing an attacker to modify the metadata of a logged-in user's uploaded file via a CSRF attack, which can be leveraged to download that file. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file. | ||||
| CVE-2026-17703 | 1 Google | 1 Chrome | 2026-08-02 | 6.5 Medium |
| Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-16232 | 1 Checkpoint | 2 Multi-domain Management, Quantum Security Management | 2026-08-02 | 9.1 Critical |
| An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. Successful exploitation allows the attacker to modify security policies and security configurations. Remote exploitation requires internet access to the Management Server IP address and a configuration that does not restrict Trusted Clients. Check Point is aware that this vulnerability is being exploited and has affected a very small number of customers. | ||||
| CVE-2026-17780 | 1 Google | 1 Chrome | 2026-08-02 | 6.3 Medium |
| Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17814 | 1 Google | 1 Chrome | 2026-08-02 | 6.5 Medium |
| Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17822 | 1 Google | 1 Chrome | 2026-08-02 | 6.5 Medium |
| Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17873 | 1 Google | 1 Chrome | 2026-08-02 | 6.5 Medium |
| Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17917 | 1 Google | 1 Chrome | 2026-08-02 | 6.5 Medium |
| Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-17941 | 1 Google | 1 Chrome | 2026-08-02 | 4.3 Medium |
| Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-17944 | 1 Google | 1 Chrome | 2026-08-02 | 4.3 Medium |
| Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-15236 | 2026-08-02 | N/A | ||
| The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account. | ||||
| CVE-2026-13389 | 2026-08-02 | N/A | ||
| The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated attackers to export and delete stored visitor consent records, create posts, and modify the webtoffee-cookie-consent WordPress plugin before 3.5.3's licensing state. | ||||
| CVE-2025-15675 | 2026-08-02 | N/A | ||
| The Charitable WordPress plugin before 1.8.5.3 does not sanitise and escape one of its campaign image text fields before outputting it in an HTML attribute, allowing users with a high-privilege campaign-management role to perform Stored Cross-Site Scripting attacks that execute on the front-end campaign page. | ||||
| CVE-2026-16540 | 2026-08-02 | N/A | ||
| The Simply Schedule Appointments WordPress plugin before 1.6.12.6 does not correctly restrict a bulk appointment operation to the requester's own records, allowing unauthenticated users to retrieve the personal data of all appointments across the site and, on premium editions, to permanently delete them. | ||||
| CVE-2026-16064 | 2026-08-02 | N/A | ||
| The Event Booking Manager for WooCommerce WordPress plugin before 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability, allowing users with the Contributor role and above to modify the title and publication status of arbitrary posts and pages on the site, including content they do not own. | ||||