Browse CVEs by Ecosystem and Severity
798 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-36097
fuadmin vulnerable to insecure file upload
CRITICAL
CVE-2023-29931
laravel-s vulnerable to Local File Inclusion
CRITICAL
CVE-2020-21489
Liufee CMS File Upload vulnerability
CRITICAL
CVE-2020-21174
liufee CMS File Upload vulnerability
HIGH
CVE-2023-29297
Magento Open Source allows Improper Neutralization of Special Elements Used
CRITICAL
CVE-2023-3173
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts
CRITICAL
CVE-2023-32692
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4
CRITICAL
CVE-2023-27238
LavaLite vulnerable to web cache poisoning
CRITICAL
CVE-2023-2531
AzuraCast missing brute force prevention
CRITICAL
CVE-2023-28473
Concrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section
CRITICAL
CVE-2020-36070
Remote code execution in Voyager
CRITICAL
CVE-2023-30839
SQL filter bypass leading to arbitrary write requests using "SQL Manager"
CRITICAL
CVE-2023-29141
X-Forwarded-For header allows brute-forcing autoblocked IP addresses
CRITICAL
CVE-2023-28333
Moodle's Mustache pix helper contained a potential Mustache injection risk if combined with user input
CRITICAL
CVE-2023-25655
baserCMS allows any file to be uploaded
CRITICAL
CVE-2023-25654
baserCMS File Uploader Remote Code Execution (RCE) vulnerability
CRITICAL
CVE-2023-28115
PHAR deserialization allowing remote code execution
CRITICAL
CVE-2022-48367
Access control issue in ezsystems/ezpublish-kernel
CRITICAL
CVE-2023-24774
Funadmin vulnerable to SQL injection
CRITICAL
CVE-2023-1307
Froxlor is vulnerable to authentication bypass
CRITICAL
CVE-2023-24777
SQL Injection in Funadmin
CRITICAL
CVE-2023-24782
SQL Injection in Funadmin
CRITICAL
CVE-2023-24773
SQL Injection in Funadmin
CRITICAL
CVE-2023-1269
Easy!Appointments uses hard-coded credentials
CRITICAL
CVE-2023-24780
SQL Injection in Funadmin
CRITICAL
CVE-2023-24775
SQL Injection in Funadmin
CRITICAL
CVE-2023-24781
SQL Injection in Funadmin
CRITICAL
CVE-2021-36394
Moodle Session Fixation vulnerability
CRITICAL
CVE-2023-24776
Remote code execution in Funadmin
CRITICAL
CVE-2021-36393
Moodle SQL Injection vulnerability
CRITICAL
CVE-2021-36392
Moodle SQL Injection vulnerability
CRITICAL
CVE-2023-0789
Command Injection in thorsten/phpmyfaq
CRITICAL
CVE-2023-0788
Code Injection in thorsten/phpmyfaq
CRITICAL
CVE-2015-10077
SQL injection in webbuilders-group silverstripe-kapost-bridge
HIGH
CVE-2023-24814
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
CRITICAL
CVE-2022-45982
Deserialization of Untrusted Data in thinkphp
CRITICAL
CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
CRITICAL
CVE-2015-10073
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function
CRITICAL
CVE-2023-25313
AVideo contains Command injection when embedding a video link
CRITICAL
CVE-2023-23924
Dompdf vulnerable to URI validation failure on SVG parsing
CRITICAL
CVE-2020-22452
phpmyadmin contains SQL Injection vulnerability
CRITICAL
CVE-2021-26642
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2023-22727
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection
CRITICAL
CVE-2023-22731
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views
CRITICAL
CVE-2016-15020
SQL Injection in liftkit/database
CRITICAL
CVE-2023-0311
phpMyFAQ Improper Authentication vulnerability
CRITICAL
CVE-2021-4308
WebPA SQL Injection vulnerability
CRITICAL
CVE-2014-125029
PaginationServiceProvider SQL Injection vulnerability
CRITICAL
CVE-2015-10029
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2014-125051
himiklab yii2-jqgrid-widget vulnerable to SQL Injection