In Toll Tax Management System 1.0, the id parameter appears to be vulnerable to SQL injection attacks.
In Home Clean Service System 1.0, the password parameter is vulnerable to SQL injection attacks.
A remote bypass security restrictions vulnerability was discovered in HPE OneView version(s): Prior to 7.0. HPE has prov
FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to ser
The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via t
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the
An out-of-bounds read vulnerability was discovered in the PCRE2 library in the compile_xclass_matchingpath() function of
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10
A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and bel
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and bel
A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and bel
Metasonic Doc WebClient 7.0.14.0 / 7.0.12.0 / 7.0.3.0 is vulnerable to a SQL injection attack in the username field. SSO
The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to exec
The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attac
The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated
Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.
An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below
The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not validate a parameter in its forms wh
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it
An arbitrary file upload vulnerability in formidable v3.1.4 allows attackers to execute arbitrary code via a crafted fil
An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrar
An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute a
An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbit
A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[
In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability.
nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fai
Calibre-Web before 0.6.18 allows user table SQL Injection.
ERP-Pro v3.7.5 was discovered to contain a SQL injection vulnerability via the component /base/SysEveMenuAuthPointMapper
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the delid parameter at viewt
URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass U
SonicWall SMA1000 series firmware 12.4.0, 12.4.1-02965 and earlier versions incorrectly restricts access to a resource u
Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07.
Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=delete_applic
Pharmacy Sales And Inventory System v1.0 is vulnerable to SQL Injection via /pharmacy-sales-and-inventory-system/manage_
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_cart.
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_sub_categor
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_category.
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=pay_order.
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_featured.
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_order.
Merchandise Online Store v1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_inventory.
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will
BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to del
The kernel module has a UAF vulnerability.Successful exploitation of this vulnerability will affect data integrity and a
The audio module has a vulnerability in verifying the parameters passed by the application space.Successful exploitation
Frequently Asked Questions
What does CRITICAL severity mean for CVEs?
CVSS 9.0–10.0 — vulnerabilities that allow remote code execution, full system compromise, or trivial exploitation with no authentication required
How many critical severity CVEs exist?
There are 35,149 CVE records rated CRITICAL in our database. Of these, 312 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize critical severity vulnerabilities?
CRITICAL severity vulnerabilities should be patched immediately, especially if they are in the CISA KEV catalog or have a high EPSS score. Use CyberStrike to automatically detect and prioritize these vulnerabilities across your infrastructure.
Detect CRITICAL Vulnerabilities
CyberStrike scans your infrastructure and detects critical severity vulnerabilities in real time.
Get Started