Browse CVEs by Ecosystem and Severity
393 CVEs, newest first — with EPSS exploit probability and CISA KEV status, not just CVSS severity.
CRITICAL
CVE-2023-25654
baserCMS File Uploader Remote Code Execution (RCE) vulnerability
CRITICAL
CVE-2023-28115
PHAR deserialization allowing remote code execution
CRITICAL
CVE-2022-48367
Access control issue in ezsystems/ezpublish-kernel
CRITICAL
CVE-2023-24774
Funadmin vulnerable to SQL injection
CRITICAL
CVE-2023-1307
Froxlor is vulnerable to authentication bypass
CRITICAL
CVE-2023-24777
SQL Injection in Funadmin
CRITICAL
CVE-2023-24782
SQL Injection in Funadmin
CRITICAL
CVE-2023-24773
SQL Injection in Funadmin
CRITICAL
CVE-2023-1269
Easy!Appointments uses hard-coded credentials
CRITICAL
CVE-2023-24780
SQL Injection in Funadmin
CRITICAL
CVE-2023-24775
SQL Injection in Funadmin
CRITICAL
CVE-2023-24781
SQL Injection in Funadmin
CRITICAL
CVE-2021-36394
Moodle Session Fixation vulnerability
CRITICAL
CVE-2023-24776
Remote code execution in Funadmin
CRITICAL
CVE-2021-36393
Moodle SQL Injection vulnerability
CRITICAL
CVE-2021-36392
Moodle SQL Injection vulnerability
CRITICAL
CVE-2023-0789
Command Injection in thorsten/phpmyfaq
CRITICAL
CVE-2023-0788
Code Injection in thorsten/phpmyfaq
CRITICAL
CVE-2015-10077
SQL injection in webbuilders-group silverstripe-kapost-bridge
CRITICAL
CVE-2022-45982
Deserialization of Untrusted Data in thinkphp
CRITICAL
CVE-2023-24813
URI validation failure on SVG parsing. Bypass of CVE-2023-23924
CRITICAL
CVE-2015-10073
tinymighty WikiSEO is vulnerable to cross-site scripting via modifyHTML function
CRITICAL
CVE-2023-25313
AVideo contains Command injection when embedding a video link
CRITICAL
CVE-2023-23924
Dompdf vulnerable to URI validation failure on SVG parsing
CRITICAL
CVE-2020-22452
phpmyadmin contains SQL Injection vulnerability
CRITICAL
CVE-2021-26642
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type
CRITICAL
CVE-2023-22727
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection
CRITICAL
CVE-2023-22731
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views
CRITICAL
CVE-2016-15020
SQL Injection in liftkit/database
CRITICAL
CVE-2023-0311
phpMyFAQ Improper Authentication vulnerability
CRITICAL
CVE-2021-4308
WebPA SQL Injection vulnerability
CRITICAL
CVE-2014-125029
PaginationServiceProvider SQL Injection vulnerability
CRITICAL
CVE-2015-10029
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference
CRITICAL
CVE-2014-125051
himiklab yii2-jqgrid-widget vulnerable to SQL Injection
CRITICAL
CVE-2015-10018
DBRisinajumi d2files SQL Injection vulnerability
CRITICAL
CVE-2015-10009
nterchange Code Injection vulnerability
CRITICAL
CVE-2017-20157
Ariadne Component Library vulnerable to Server-Side Request Forgery
CRITICAL
CVE-2022-47945
ThinkPHP Framework vulnerable to remote code execution
CRITICAL
CVE-2021-4262
laravel-jqgrid vulnerable to SQL Injection
CRITICAL
CVE-2022-47406
TYPO3 vulnerable to Insufficient Session Expiration
CRITICAL
CVE-2022-44136
Zenario CMS is vulnerable to Remote Code Execution (RCE).
CRITICAL
CVE-2022-41705
Badaso vulnerable to Remote Code Execution (RCE)
CRITICAL
CVE-2022-4093
SQL injection in Dolibarr
CRITICAL
CVE-2022-4070
Insufficient Session Expiration in librenms/librenms
CRITICAL
CVE-2022-43138
Dolibarr vulnerable to privilege escalation
CRITICAL
CVE-2022-3827
Centreon vulnerable to SQL Injection
CRITICAL
CVE-2022-3771
easyii CMS's File Upload Management vulnerable to unrestricted upload
CRITICAL
CVE-2022-3754
phpMyFAQ contains Weak Password Requirements
CRITICAL
CVE-2022-39365
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
CRITICAL
CVE-2022-41711
Badaso vulnerable to Remote Code Execution via malicious file upload