Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Web Application Vulnerabilities

This page lists 25223 vulnerabilities in 64 categories.

Critical: 1706 High: 13413 Medium: 9129 Low: 904 Information: 71
Vulnerability Name
CVE
CWE
Severity
CrushFTP Authentication Bypass (CVE-2025-2825)
CVE-2025-2825
CWE-287
Critical
CrushFTP Server Deserialization of Untrusted Data Vulnerability (CVE-2017-14035)
CVE-2017-14035
CWE-502
Critical
CrushFTP Server Improper Control of Dynamically-Managed Code Resources Vulnerability (CVE-2023-43177)
CVE-2023-43177
CWE-913
Critical
CrushFTP Server Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-4040)
CVE-2024-4040
CWE-94
Critical
CrushFTP Server Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2025-32103)
CVE-2025-32103
CWE-22
Medium
CrushFTP Server Improper Neutralization of CRLF Sequences ('CRLF Injection') Vulnerability (CVE-2017-14037)
CVE-2017-14037
CWE-707
Medium
CrushFTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-14036)
CVE-2017-14036
CWE-707
Medium
CrushFTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-44076)
CVE-2021-44076
CWE-707
Medium
CrushFTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-22910)
CVE-2024-22910
CWE-707
Medium
CrushFTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-63419)
CVE-2025-63419
CWE-707
Medium
CrushFTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-63420)
CVE-2025-63420
CWE-707
Medium
CrushFTP Server Improper Validation of Integrity Check Value Vulnerability (CVE-2023-48795)
CVE-2023-48795
CWE-354
Medium
CrushFTP Server Other Vulnerability (CVE-2025-31161)
CVE-2025-31161
-
Critical
CrushFTP Server Server-Side Request Forgery (SSRF) Vulnerability (CVE-2025-32102)
CVE-2025-32102
CWE-918
Medium
CrushFTP Server Unprotected Alternate Channel Vulnerability (CVE-2025-54309)
CVE-2025-54309
CWE-420
Critical
CrushFTP Server URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2017-14038)
CVE-2017-14038
CWE-601
Medium
CrushFTP Server URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2018-18288)
CVE-2018-18288
CWE-601
Medium
CrushFTP Server Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2024-53552)
CVE-2024-53552
CWE-640
Critical
CrushFTP SSTI (CVE-2024-4040)
CVE-2024-4040
CWE-94
Critical
CubeCart Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2023-38130)
CVE-2023-38130
CWE-352
High
CubeCart Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-3724)
CVE-2011-3724
CWE-200
Medium
CubeCart Improper Access Control Vulnerability (CVE-2015-6928)
CVE-2015-6928
CWE-284
Medium
CubeCart Improper Authentication Vulnerability (CVE-2014-2341)
CVE-2014-2341
CWE-287
Medium
CubeCart Improper Input Validation Vulnerability (CVE-2012-0865)
CVE-2012-0865
CWE-20
Medium
CubeCart Improper Input Validation Vulnerability (CVE-2013-1465)
CVE-2013-1465
CWE-20
High
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-2090)
CVE-2017-2090
CWE-22
Medium
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-2098)
CVE-2017-2098
CWE-22
Medium
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-2117)
CVE-2017-2117
CWE-22
Medium
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-42428)
CVE-2023-42428
CWE-22
Medium
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-47283)
CVE-2023-47283
CWE-22
Medium
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2024-34832)
CVE-2024-34832
CWE-22
Critical
CubeCart Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2026-35496)
CVE-2026-35496
CWE-22
Low
CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-1550)
CVE-2008-1550
CWE-707
Medium
CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-20703)
CVE-2018-20703
CWE-707
Medium
CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59411)
CVE-2025-59411
CWE-707
Medium
CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59412)
CVE-2025-59412
CWE-707
Medium
CubeCart Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2023-47675)
CVE-2023-47675
CWE-138
High
CubeCart Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') Vulnerability (CVE-2026-21719)
CVE-2026-21719
CWE-138
High
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2009-4060)
CVE-2009-4060
CWE-138
High
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2010-1931)
CVE-2010-1931
CWE-138
High
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2010-4903)
CVE-2010-4903
CWE-138
High
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-20716)
CVE-2018-20716
CWE-138
Critical
CubeCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2026-34018)
CVE-2026-34018
CWE-138
Critical
CubeCart Insufficient Session Expiration Vulnerability (CVE-2025-59335)
CVE-2025-59335
CWE-613
High
CubeCart Missing Authorization Vulnerability (CVE-2025-59413)
CVE-2025-59413
CWE-862
Medium
CubeCart Permissions, Privileges, and Access Controls Vulnerability (CVE-2009-3904)
CVE-2009-3904
CWE-264
High
CubeCart Session Fixation Vulnerability (CVE-2021-33394)
CVE-2021-33394
CWE-384
Medium
CubeCart Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2024-33438)
CVE-2024-33438
CWE-434
High
Custom Error Pages Are Not Configured in WEB-INF/web.xml
-
CWE-209
Medium
Custom Vulnerability Alert
-
CWE-0
High
CVS Detected
-
CWE-527
Medium
CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution (CVE-2025-48703)
CVE-2025-48703
CWE-78
Critical
CyberPanel RCE (CVE-2024-51567/CVE-2024-51568/CVE-2024-51378)
CVE-2024-51378
CWE-306
Critical
D-Link NAS Backdoor Account RCE (CVE-2024-3273, CVE-2024-3272)
CVE-2024-3272
CWE-77
Critical
D3.js Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-16044)
CVE-2017-16044
CWE-200
High
Data Binding Expression Vulnerability in Spring Web Flow
CVE-2017-4971
CWE-78
High
data: Used in a Content Security Policy (CSP) Directive
-
CWE-942
Information
Database User Has Admin Privileges
-
CWE-267
High
datatables Cross-site Scripting (XSS) Vulnerability (CVE-2015-6584)
CVE-2015-6584
-
Medium
DataTables Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2025-11031)
CVE-2025-11031
CWE-22
Medium
DataTables Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-23445)
CVE-2021-23445
CWE-707
Medium
DataTables Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36713)
CVE-2021-36713
CWE-707
Medium
DataTables Prototype Pollution Vulnerability (CVE-2020-28458)
CVE-2020-28458
-
High
default-src Used in Content Security Policy (CSP)
-
CWE-942
Information
Delve Debugger Unauthorized Access Vulnerability
-
CWE-200
High
Deprecated Header Instruction Used to Implement Content Security Policy (CSP)
-
CWE-358
Information
Deserialization of Untrusted Data (.NET BinaryFormatter Object Deserialization)
-
CWE-502
High
Deserialization of Untrusted Data (Java JSON Deserialization) Fastjson
-
CWE-502
High
Deserialization of Untrusted Data (Java JSON Deserialization) Genson
-
CWE-502
High
Deserialization of Untrusted Data (Java JSON Deserialization) Jackson
CVE-2017-7525
CWE-502
High
Deserialization of Untrusted Data (Java JSON Deserialization) JsonIO
-
CWE-502
High
Deserialization of Untrusted Data (Java Object Deserialization)
-
CWE-502
High
Deserialization of Untrusted Data (XStream)
CVE-2020-26217
CWE-502
High
Development configuration files
-
CWE-538
Medium
Devise weak password
-
CWE-200
High