Total
413911 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-19885 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST['pageparam_insert_name']' variable in dbhcms\mod\mod.page.edit.php line 227, A remote authenticated with admin user can exploit this vulnerability to hijack other users. | |||||
| CVE-2020-19884 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function in dbhcms\mod\mod.domain.edit.php line 119. | |||||
| CVE-2020-19883 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter in dbhcms\mod\mod.users.view.php line 57 for user_login, A remote authenticated with admin user can exploit this vulnerability to hijack other users. | |||||
| CVE-2020-19882 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu_description' variable in dbhcms\mod\mod.menus.edit.php line 83 and in dbhcms\mod\mod.menus.view.php line 111, A remote authenticated with admin user can exploit this vulnerability to hijack other users. | |||||
| CVE-2020-19881 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| DBHcms v1.2.0 has a reflected xss vulnerability as there is no security filter in dbhcms\mod\mod.selector.php line 108 for $_GET['return_name'] parameter, A remote authenticated with admin user can exploit this vulnerability to hijack other users. | |||||
| CVE-2020-19880 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function form 'Name' in dbhcms\types.php, A remote unauthenticated attacker can exploit this vulnerability to hijack other users. | |||||
| CVE-2020-19879 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $_GET['dbhcms_pid'] variable in dbhcms\page.php line 107, | |||||
| CVE-2020-19878 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| DBHcms v1.2.0 has a sensitive information leaks vulnerability as there is no security access control in /dbhcms/ext/news/ext.news.be.php, A remote unauthenticated attacker can exploit this vulnerability to get path information. | |||||
| CVE-2020-19877 | 1 Dbhcms Project | 1 Dbhcms | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| DBHcms v1.2.0 has a directory traversal vulnerability as there is no directory control function in directory /dbhcms/. A remote unauthenticated attacker can exploit this vulnerability to obtain server-sensitive information. | |||||
| CVE-2020-19861 | 1 Nlnetlabs | 1 Ldns | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too trusted for the length value obtained from the zone file. When the memcpy is copied, the 0xfe - ldns_rdf_size(salt_rdf) byte data can be copied, causing heap overflow information leakage. | |||||
| CVE-2020-19860 | 1 Nlnetlabs | 1 Ldns | 2026-06-17 | 4.3 MEDIUM | 6.5 MEDIUM |
| When ldns version 1.7.1 verifies a zone file, the ldns_rr_new_frm_str_internal function has a heap out of bounds read vulnerability. An attacker can leak information on the heap by constructing a zone file payload. | |||||
| CVE-2020-19858 | 1 Plutinosoft | 1 Platinum | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Platinum Upnp SDK through 1.2.0 has a directory traversal vulnerability. The attack could remote attack victim by sending http://ip:port/../privacy.avi URL to compromise a victim's privacy. | |||||
| CVE-2020-19855 | 1 Phpwcms | 1 Phpwcms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| phpwcms v1.9 contains a cross-site scripting (XSS) vulnerability in /image_zoom.php. | |||||
| CVE-2020-19853 | 1 Bluecms Project | 1 Bluecms | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| BlueCMS v1.6 contains a SQL injection vulnerability via /ad_js.php. | |||||
| CVE-2020-19850 | 1 Monospace | 1 Directus | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests. | |||||
| CVE-2020-19825 | 1 Kimai | 1 Kimai | 2026-06-17 | N/A | 9.6 CRITICAL |
| Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges. | |||||
| CVE-2020-19824 | 1 Mpv | 1 Mpv | 2026-06-17 | N/A | 7.0 HIGH |
| An issue in MPV v.0.29.1 fixed in v0.30 allows attackers to execute arbitrary code and crash program via the ao_c parameter. | |||||
| CVE-2020-19822 | 1 Zzcms | 1 Zzcms | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| A remote code execution (RCE) vulnerability in template_user.php of ZZCMS version 2018 allows attackers to execute arbitrary PHP code via the "ml" and "title" parameters. | |||||
| CVE-2020-19821 | 1 Wdoyo | 1 Doyocms | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| A SQL injection vulnerability in admin.php of DOYOCMS 2.3 allows attackers to execute arbitrary SQL commands via the orders[] parameter. | |||||
| CVE-2020-19803 | 1 Doyocms Project | 1 Doyocms | 2026-06-17 | N/A | 8.8 HIGH |
| Cross Site Request Forgery vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the background system settings. | |||||