Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
v.26.4.2314

Known Vulnerabilities

This page lists 15405 vulnerabilities in this category.

Critical: 1674 High: 4167 Medium: 8767 Low: 793 Information: 4
Vulnerability Name
CVE
CWE
Severity
Nginx PHP code execution via FastCGI
-
CWE-94
High
XWikiplatform Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-31465)
CVE-2024-31465
CWE-94
High
Remote File Inclusion (admin/lang.php) (CMS Made Simple)
CVE-2005-2846
CWE-98
High
SQL Injection (stylesheet.php) (CMS Made Simple)
CVE-2007-2473
CWE-89
High
Serendipity Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-2332)
CVE-2012-2332
CWE-138
High
Grafana CVE-2024-1442 Vulnerability (CVE-2024-1442)
CVE-2024-1442
-
High
PHP Resource Management Errors Vulnerability (CVE-2012-0830)
CVE-2012-0830
-
High
Atlassian Crowd Remote Code Execution
CVE-2019-11580
CWE-78
High
Internet Information Services Other Vulnerability (CVE-1999-0412)
CVE-1999-0412
-
High
Atlassian Confluence Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-21674)
CVE-2024-21674
CWE-94
High
Authentication bypass via MongoDB operator injection
-
CWE-943
High
RCE in SQL Server Reporting Services (SSRS)
CVE-2020-0618
CWE-78
High
Apache Tomcat CVE-2024-24549 Vulnerability (CVE-2024-24549)
CVE-2024-24549
-
High
Jenkins Origin Validation Error Vulnerability (CVE-2024-23898)
CVE-2024-23898
CWE-346
High
Directory Traversal with spring-cloud-config-server
CVE-2020-5410
CWE-22
High
Atlassian Confluence Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-21673)
CVE-2024-21673
CWE-94
High
vBulletin Pre-Auth RCE Vulnerability
CVE-2020-17496
CWE-94
High
AjaxPro.NET Professional Deserialization RCE (CVE-2021-23758)
CVE-2021-23758
CWE-502
High
VMware vCenter Server Unauthorized Remote Code Execution
CVE-2021-21972
CWE-78
High
Plone CMS CVE-2024-23756 Vulnerability (CVE-2024-23756)
CVE-2024-23756
-
High
vBulletin 5.6.1 nodeId SQL injection
CVE-2020-12720
CWE-94
High
spring-boot-actuator-logview Path Traversal
CVE-2021-21234
CWE-22
High
Remote code execution of user-provided local names in Rails
CVE-2020-8163
CWE-94
High
Reflected Cross-Site Scripting (XSS) vulnerability in PAN-OS management web interface
CVE-2020-2036
CWE-79
High
ntopng Authentication Bypass (CVE-2021-28073)
CVE-2021-28073
CWE-287
High
Atlassian Confluence Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2024-21677)
CVE-2024-21677
CWE-22
High
Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21678)
CVE-2024-21678
CWE-707
High
Alibaba Nacos Authentication Bypass (CVE-2021-29441)
CVE-2021-29441
CWE-287
High
Atlassian Confluence CVE-2024-21683 Vulnerability (CVE-2024-21683)
CVE-2024-21683
-
High
SSRF via logo_uri in MITREid Connect
CVE-2021-26715
CWE-918
High
Microsoft Exchange Server Pre-auth Path Confusion vulnerability (CVE-2021-34473)
CVE-2021-34473
CWE-918
High
PHP Numeric Errors Vulnerability (CVE-2012-2386)
CVE-2012-2386
-
High
Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21686)
CVE-2024-21686
CWE-707
High
Atlassian Confluence Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-21690)
CVE-2024-21690
CWE-707
High
Bonita Authorization Bypass (CVE-2022-25237)
CVE-2022-25237
CWE-863
High
Django CVE-2024-24680 Vulnerability (CVE-2024-24680)
CVE-2024-24680
-
High
Microsoft Exchange Server Server-Side Request Forgery (SSRF) vulnerability
CVE-2021-26855
CWE-918
High
Squid Uncontrolled Recursion Vulnerability (CVE-2024-25111)
CVE-2024-25111
CWE-674
High
MobileIron Log4Shell RCE
CVE-2021-44228
CWE-78
High
Fortinet Authentication bypass on administrative interface
CVE-2022-40684
CWE-288
High
elFinder RCE (CVE-2021-32682)
CVE-2021-32682
CWE-22
High
BillQuick Web Suite SQL injection (CVE-2021-42258)
CVE-2021-42258
CWE-89
High
Grafana avatar SSRF
CVE-2020-13379
CWE-78
High
Craft CMS CVE-2024-21622 Vulnerability (CVE-2024-21622)
CVE-2024-21622
-
High
Apache Solr Log4Shell RCE
CVE-2021-44228
CWE-78
High
PostgreSQL Other Vulnerability (CVE-2012-1618)
CVE-2012-1618
-
High
MongoDB $where operator JavaScript injection
-
CWE-943
High
Metabase Local File Inclusion (CVE-2021-41277)
CVE-2021-41277
CWE-200
High
Oracle Database Server Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-1675)
CVE-2012-1675
CWE-264
High
Unauthenticated Remote Code Execution via JSONWS in Liferay 7.2.0 CE GA1
CVE-2020-7961
CWE-78
High
Unauthenticated remote code execution vulnerability in Confluence Server and Data Center
CVE-2022-26134
CWE-917
High
ManageEngine Desktop Central Deserialization RCE (CVE-2020-10189)
CVE-2020-10189
CWE-502
High
MobileIron Remote Code Execution via LogService
CVE-2020-15505
CWE-78
High
XWiki Improper Handling of Insufficient Privileges Vulnerability (CVE-2024-21648)
CVE-2024-21648
CWE-274
High
Jenkins Git Plugin missing permission check (CVE-2022-36883)
CVE-2022-36883
CWE-862
High
SharePoint Out-of-bounds Write Vulnerability (CVE-2012-2539)
CVE-2012-2539
CWE-787
High
Nette framework PHP code injection via callback
CVE-2020-15227
CWE-94
High
DotCMS unrestricted file upload (CVE-2022-26352)
CVE-2022-26352
CWE-434
High
GeoServer Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2024-24749)
CVE-2024-24749
CWE-22
High
Atlassian Confluence Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-21672)
CVE-2024-21672
CWE-94
High
GibbonEdu Deserialization of Untrusted Data Vulnerability (CVE-2024-24725)
CVE-2024-24725
CWE-502
High
Openfire Admin Console Full Read SSRF
CVE-2019-18394
CWE-918
High
WordPress Theme OneTone: Unauthenticated Stored Cross-Site Scripting (XSS)
CVE-2019-17231
CWE-79
High
Agentejo Cockpit CMS resetpassword NoSQLi (CVE-2020-35847)
CVE-2020-35847
CWE-89
High
Apache OFBiz Log4Shell RCE
CVE-2021-44228
CWE-78
High
Jetty Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-22201)
CVE-2024-22201
CWE-770
High
GoCD information disclosure (CVE-2021-43287)
CVE-2021-43287
CWE-200
High
Grav CMS Unauthenticated RCE (CVE-2021-21425)
CVE-2021-21425
CWE-284
High
ManageEngine ADSelfService Plus Authentication Bypass (CVE-2021-40539)
CVE-2021-40539
CWE-287
High
IBMHttpServer Heap-based Buffer Overflow Vulnerability (CVE-2026-8834)
CVE-2026-8834
CWE-122
High
TYPO3 Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2024-22188)
CVE-2024-22188
CWE-94
High
Apache Flink jobmanager/logs Path Traversal
CVE-2020-17519
CWE-22
High
PHP Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2012-2311)
CVE-2012-2311
CWE-138
High
JBoss Application Server Improper Privilege Management Vulnerability (CVE-2012-2312)
CVE-2012-2312
CWE-269
High
Apache Airflow Experimental API Auth Bypass CVE-2020-13927
CVE-2020-13927
CWE-200
High