CVE Database and Vulnerability Search

Browse vendorsBrowse ecosystems

Search CVE and GHSA vulnerability records by identifier, title, vendor, product, package, or CWE. Filter by severity, CISA KEV, ransomware association, linked artifacts, and Nuclei templates; sort by publication date, CVSS, or EPSS.

Vulnerabilities
381,276
with PoCs
37,250
CISA KEV
1,665
Ransomware
606
with Nuclei
4,342
Advanced

Showing 7 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Reflected Cross-Site Scripting (XSS) in Wirtualna Uczelnia

Wirtualna Uczelnia is vulnerable to Reflected Cross‑Site Scripting (XSS) due to insecure handling of the locale parameter across multiple endpoints. An attacker can craft a malicious URL with JavaScript embedded in the locale parameter and send it to a victim. When the victim opens the link, the injected script will be executed in their browser. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20260327_105545

CWE-79Jun 2, 2026
CVSS5.1v4.0EPSS0.285%PoCs0SignalsSTIX

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia

Server-Side Template Injection (SSTI) in Wirtualna Uczelnia allows an unauthenticated attacker to perform Remote Code Execution (RCE). In the endpoint redirectToUrl and parameter redirectUrlParameter, insufficient input validation permits injection of arbitrary template expressions that are executed on the server. Successful exploitation can allow an attacker to run remote commands, including establishing a reverse shell. This issue affects Wirtualna Uczelnia versions up to wu#2016.437.295#0#20…

CWE-1336Jun 2, 2026
CVSS9.3v4.0EPSS0.557%PoCs0SignalsSTIX

SQL Injection in SIMPLE.ERP

SIMPLE.ERP is vulnerable to the SQL Injection in search functionality in "Obroty na kontach" window. Lack of input validation allows an authenticated attacker to prepare a malicious query to the database that will be executed. This issue was fixed in 6.30@A04.4_u06.

CWE-89Feb 26, 2026
CVSS8.6v4.0EPSS0.307%PoCs0SignalsSTIX

RCE in Wirtualna Uczelnia

The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application interprets the entered string of characters as a Java expression, allowing an unauthenticated attacer to perform arbitrary code execution. This issue was fixed in version wu#2016.1.5513#0#20251014_113353

CWE-95Nov 27, 2025
CVSS9.3v4.0EPSS0.401%PoCs0SignalsSTIX

SQL Injection in SIMPLE.ERP

SQL injection vulnerability in the fields of warehouse document filtering form in SIMPLE.ERP software allows logged-in user a malicious query injection. Potential exploitation is limited by the 20-character limit in form fields. Identified use case allows to delete tables with a name of maximum 6 characters. We weren't able to identify a way to exfiltrate data within query character limit. This issue affects SIMPLE.ERP in versions before 6.30@a04.3.

CWE-89Oct 21, 2025
CVSS7.1v4.0EPSS0.262%PoCs0SignalsSTIX

Privilege Escalation in SIMPLE.ERP

The SIMPLE.ERP client stores superuser password in a recoverable format, allowing any authenticated SIMPLE.ERP user to escalate privileges to a database administrator. This issue affect SIMPLE.ERP from 6.20 through 6.30. Only the 6.30 version received a patch 6.30@a03.9, which removed the vulnerability. Versions 6.20 and 6.25 remain unpatched.

CWE-257Mar 24, 2025
CVSS7.7v4.0EPSS0.317%PoCs0SignalsSTIX

Protocol Downgrade in SIMPLE.ERP

SIMPLE.ERP client is vulnerable to MS SQL protocol downgrade request from a server side, what could lead to an unencrypted communication vulnerable to data interception and modification. This issue affect SIMPLE.ERP from 6.20 to 6.30. Only the 6.30 version received a patch 6.30@a03.9, which make it possible for an administrator to enforce encrypted communication. Versions 6.20 and 6.25 remain unpatched.

CWE-757Mar 24, 2025
CVSS8.3v4.0EPSS0.415%PoCs0SignalsSTIX