Total
403841 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-15148 | 1 Open-emr | 1 Openemr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| SQL injection vulnerability in interface/patient_file/encounter/search_code.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter. | |||||
| CVE-2018-15147 | 1 Open-emr | 1 Openemr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| SQL injection vulnerability in interface/forms_admin/forms_admin.php from library/registry.inc in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'id' parameter. | |||||
| CVE-2018-15146 | 1 Open-emr | 1 Openemr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| SQL injection vulnerability in interface/de_identification_forms/find_immunization_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'search_term' parameter. | |||||
| CVE-2018-15145 | 1 Open-emr | 1 Openemr | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL injection vulnerabilities in portal/add_edit_event_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) eid, (2) userid, or (3) pid parameter. | |||||
| CVE-2018-15144 | 1 Open-emr | 1 Openemr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| SQL injection vulnerability in interface/de_identification_forms/find_drug_popup.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the search_term parameter. | |||||
| CVE-2018-15143 | 1 Open-emr | 1 Openemr | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| Multiple SQL injection vulnerabilities in portal/find_appt_popup_user.php in versions of OpenEMR before 5.0.1.4 allow a remote attacker to execute arbitrary SQL commands via the (1) catid or (2) providerid parameter. | |||||
| CVE-2018-15142 | 1 Open-emr | 1 Openemr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to execute arbitrary PHP code by writing a file with a PHP extension via the "docid" and "content" parameters and accessing it in the traversed directory. | |||||
| CVE-2018-15141 | 1 Open-emr | 1 Openemr | 2026-06-17 | 5.5 MEDIUM | 6.5 MEDIUM |
| Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to delete arbitrary files via the "docid" parameter when the mode is set to delete. | |||||
| CVE-2018-15140 | 1 Open-emr | 1 Openemr | 2026-06-17 | 4.0 MEDIUM | 6.5 MEDIUM |
| Directory traversal in portal/import_template.php in versions of OpenEMR before 5.0.1.4 allows a remote attacker authenticated in the patient portal to read arbitrary files via the "docid" parameter when the mode is set to get. | |||||
| CVE-2018-15139 | 1 Open-emr | 1 Openemr | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| Unrestricted file upload in interface/super/manage_site_files.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary PHP code by uploading a file with a PHP extension via the images upload form and accessing it in the images directory. | |||||
| CVE-2018-15138 | 1 Ericssonlg | 1 Ipecs Nms | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs. | |||||
| CVE-2018-15137 | 1 Cela Link | 2 Clr-m20, Clr-m20 Firmware | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g., asp, aspx, cfm, html, jhtml, jsp, or shtml), which causes remote code execution as well. Because of the WebDAV feature, it is possible to upload arbitrary files by utilizing the PUT method. | |||||
| CVE-2018-15136 | 1 Titanhq | 1 Spamtitan | 2026-06-17 | 2.6 LOW | 5.3 MEDIUM |
| TitanHQ SpamTitan before 7.01 has Improper input validation. This allows internal attackers to bypass the anti-spam filter to send malicious emails to an entire organization by modifying the URL requests sent to the application. | |||||
| CVE-2018-15133 | 1 Laravel | 1 Laravel | 2026-06-17 | 6.8 MEDIUM | 8.1 HIGH |
| In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack. | |||||
| CVE-2018-15132 | 2 Netapp, Php | 2 Storage Automation Store, Php | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in ext/standard/link_win32.c in PHP before 5.6.37, 7.0.x before 7.0.31, 7.1.x before 7.1.20, and 7.2.x before 7.2.8. The linkinfo function on Windows doesn't implement the open_basedir check. This could be abused to find files on paths outside of the allowed directories. | |||||
| CVE-2018-15131 | 1 Synacor | 1 Zimbra Collaboration Suite | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| An issue was discovered in Synacor Zimbra Collaboration Suite 8.6.x before 8.6.0 Patch 11, 8.7.x before 8.7.11 Patch 6, 8.8.x before 8.8.8 Patch 9, and 8.8.9 before 8.8.9 Patch 3. Account number enumeration is possible via inconsistent responses for specific types of authentication requests. | |||||
| CVE-2018-15130 | 1 Thinksaas | 1 Thinksaas | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter. | |||||
| CVE-2018-15129 | 1 Thinksaas | 1 Thinksaas | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter. | |||||
| CVE-2018-15128 | 1 Polycom | 3 Group Series, Hdx, Pano | 2026-06-17 | 10.0 HIGH | 9.8 CRITICAL |
| An issue was discovered in Polycom Group Series 6.1.6.1 and earlier, HDX 3.1.12 and earlier, and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets. | |||||
| CVE-2018-15127 | 4 Canonical, Debian, Libvnc Project and 1 more | 9 Ubuntu Linux, Debian Linux, Libvncserver and 6 more | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| LibVNC before commit 502821828ed00b4a2c4bef90683d0fd88ce495de contains heap out-of-bound write vulnerability in server code of file transfer extension that can result remote code execution | |||||