Vendors / Derbynet Records 11 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 3
CVSS high 3
Exploited now Derbynet records in CISA KEV No Derbynet vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
Directory Traversal vulnerability in DerbyNet v.9.0 allows a remote attacker to execute arbitrary code via the page parameter of the kiosk.php component.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01949 · Published 2024-04-12 · No fix listed CWE-22
Priority MEDIUM 62
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component.
CVSS 3.1 MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00567 · Published 2024-04-18 · No fix listed CWE-79
Priority MEDIUM 61
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component.
CVSS 3.1 MEDIUM 6.3· Network · No auth · User interaction · EPSS 0.00551 · Published 2024-04-18 · No fix listed CWE-79
Priority MEDIUM 52
SQL Injection vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the where Clause in Racer Document Rendering
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0137 · Published 2024-04-18 · No fix listed CWE-94
Priority MEDIUM 52
SQL Injection vulnerability in DerbyNet v9.0 allows a remote attacker to execute arbitrary code via the where Clause in Award Document Rendering.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01429 · Published 2024-04-18 · No fix listed CWE-89
Priority MEDIUM 40
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component.
CVSS 3.1 HIGH 7.4· Network · No auth · User interaction · EPSS 0.01027 · Published 2024-04-18 · No fix listed CWE-79
Priority LOW 39
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php
CVSS 3.1 HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00981 · Published 2024-04-18 · No fix listed CWE-79
Priority LOW 38
SQL Injection vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary SQL commands via 'classids' Parameter in ajax/query.slide.next.inc
CVSS 3.1 HIGH 8.1· Network · No auth · No interaction · EPSS 0.00724 · Published 2024-04-18 · No fix listed CWE-89
Priority LOW 25
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0062 · Published 2024-04-18 · No fix listed CWE-79
Priority LOW 23
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.
CVSS 3.1 MEDIUM 4.6· Local · Low privileges · User interaction · EPSS 0.00341 · Published 2024-04-18 · No fix listed CWE-692
Priority LOW 22
Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component.
CVSS 3.1 MEDIUM 4.6· Network · Low privileges · User interaction · EPSS 0.00511 · Published 2024-04-18 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
3 3 5 0 0
THREATIST.IORead the docs