CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
AjaxPro.2 Deserialization Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2021-23758)
[Affected Scope] All versions of the ajaxpro.2 (Ajax.NET Professional) package
[Impact] Unauthenticated remote attackers can exploit the deserialization of untrusted data to instantiate arbitrary .NET classes, leading to Remote Code Execution (RCE)
[Mitigation] Apply the official security patch from the upstream repository, restrict unused AjaxPro handlers, or deploy WAF rules
Checkbox Survey Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2021-27852)
[Affected Scope] Checkbox Survey versions prior to 7.0, specifically affecting the CheckboxWeb.dll component
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges on the target server via untrusted data deserialization
[Mitigation] Immediately upgrade Checkbox Survey to version 7.0 or higher, and restrict external access to vulnerable endpoints
Sitecore CMS and XP AntiCSRF Module Deserialization Remote Code Execution (RCE) (CVE-2019-9874)
[Affected Scope] Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2
[Impact] Unauthenticated remote attackers can execute arbitrary code with system privileges by sending a malicious serialized .NET object in the __CSRFTOKEN HTTP POST parameter
[Mitigation] Apply official security patches, disable the vulnerable AntiCSRF module, or upgrade to a supported secure version