Lucene search
+L

1307688 matches found

Nuclei
Nuclei
added 2026/09/15 5:39 a.m.89 views

QSAN Storage Manager <3.3.3 - Cross-Site Scripting

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. id: CVE-2021-37216 info: name: QSAN Storage Manager 3.3.3 - Cross-Site...

6.1CVSS6.2AI score0.0316EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.54 views

WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting

WordPress Contact Form 7 Skins plugin 2.5.0 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the tab parameter before outputting it back in an admin page. id: CVE-2021-25063 info: name: WordPress Contact Form 7 Skins =2.5.0 - Cross-Site Scripting...

6.1CVSS6.3AI score0.0208EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.70 views

WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting

WordPress The Plus Addons for Elementor plugin before 4.1.12 is susceptible to cross-site scripting. The plugin does not properly sanitize some of its fields in the heplusmorepost AJAX action, which is exploitable by both unauthenticated and authenticated users. An attacker can inject arbitrary...

6.1CVSS6AI score0.02483EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.97 views

Prismatic < 2.8 - Cross-Site Scripting

The plugin does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator id: CVE-2021-24409 info: name: Prismatic 2.8 - Cross-Site Scripting author: Harsh...

6.1CVSS6.3AI score0.01722EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.69 views

ZoomSounds Plugin - Unauthenticated Arbitrary File Upload

ZoomSounds plugin for WordPress contains a file upload vulnerability in savepng.php id: CVE-2021-4449 info: name: ZoomSounds Plugin - Unauthenticated Arbitrary File Upload author: 0xnemian severity: critical description: | ZoomSounds plugin for WordPress contains a file upload vulnerability in...

9.8CVSS8AI score0.05439EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.40 views

Laminas Project laminas-http - Remote Code Execution

Laminas Project laminas-http 2.14.2 and Zend Framework 3.0.0 contain a deserialization vulnerability caused by destruct method in Zend\Http\Response\Stream, letting attackers control content lead to remote code execution, exploit requires attacker-controlled serialized data. id: CVE-2021-3007...

9.8CVSS8.3AI score0.75313EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.61 views

Geoserver - Server-Side Request Forgery

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. id: CVE-2021-40822 info: name: Geoserver - Server-Side Request Forgery author: For3stCo1d,aringo-bf severity: high description: GeoServer through 2.18.5 and 2.19.x throug...

7.5CVSS7.2AI score0.19259EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.50 views

WordPress JH 404 Logger <=1.1 - Cross-Site Scripting

WordPress JH 404 Logger plugin through 1.1 contains a cross-site scripting vulnerability. Referer and path of 404 pages are not properly sanitized when they are output in the WordPress dashboard, which can lead to executing arbitrary JavaScript code. id: CVE-2021-24176 info: name: WordPress JH 40...

5.4CVSS6AI score0.02044EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.42 views

CentOS Web Panel - OS Command Injection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. id: CVE-2021-31324 info: name: CentOS Web Panel - OS Command Injection author: ritikchaddha severity: critical description: | The unprivileged user portal...

10CVSS8AI score0.3486EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.114 views

D-Link DAP-1620 - Local File Inclusion

D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can lead to unauthorized internal files reading /etc/passwd and /etc/shadow. id: CVE-2021-46381 info: name: D-Link DAP-1620 - Local File Inclusion author: 0xAkoko severity: high description: D-Link DAP-1620 is...

7.5CVSS6.5AI score0.58882EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.67 views

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

6.1CVSS6.4AI score0.01582EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.88 views

Akkadian Provisioning Manager - Information Disclosure

Akkadian Provisioning Manager is susceptible to information disclosure. The restricted shell provided can be escaped by abusing the Edit MySQL Configuration command. This command launches a standard VI editor interface which can then be escaped. id: CVE-2021-31581 info: name: Akkadian Provisionin...

7.9CVSS5.6AI score0.01217EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.70 views

Pascom CPS - Local File Inclusion

Pascom packaged with Cloud Phone System CPS versions before 7.20 contain a known local file inclusion vulnerability. id: CVE-2021-45968 info: name: Pascom CPS - Local File Inclusion author: dwisiswant0 severity: high description: | Pascom packaged with Cloud Phone System CPS versions before 7.20...

7.5CVSS7.1AI score0.10385EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.92 views

AntD Admin - Sensitive Information Disclosure

AntD Admin has a security vulnerability that stems from Antd-admin 5.5.0 being affected by an incorrect access control vulnerability. Attackers can exploit this vulnerability to gain unauthorized access to some front-end interfaces, resulting in the leakage of sensitive information such as user...

7.5CVSS7.1AI score0.04388EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.104 views

Jenzabar 9.2x-9.2.2 - Cross-Site Scripting

Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting vulnerability. It allows /ics?tool=search&query. id: CVE-2021-26723 info: name: Jenzabar 9.2x-9.2.2 - Cross-Site Scripting author: pikpikcu severity: medium description: Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting...

6.1CVSS6.9AI score0.12578EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.99 views

Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting

Verint Workforce Optimization 15.2.8.10048 contains a cross-site scripting vulnerability via the control/mynotifications NEWUINAV parameter. id: CVE-2021-36450 info: name: Verint Workforce Optimization 15.2.8.10048 - Cross-Site Scripting author: atomiczsec severity: medium description: Verint...

6.1CVSS6.2AI score0.64294EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.38 views

Open Bulletin Board (OpenBB) v1.0.6 - Open Redirect/XSS

Multiple cross-site scripting XSS vulnerabilities in Open Bulletin Board OpenBB 1.0.6 and earlier allows remote attackers to inject arbitrary web script or HTML via the 1 redirect parameter to member.php, 2 to parameter to myhome.php 3 TID parameter to post.php, or 4 redirect parameter to...

4.3CVSS5.9AI score0.09001EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.48 views

WordPress Plugin Age Verification v0.4 - Open Redirect

Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirectto parameter. id: CVE-2012-6499 info: name: WordPress Plugin Age...

5.8CVSS6AI score0.10557EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.49 views

WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting

A cross-site scripting vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. id: CVE-2012-4768 info: name: WordPress Plugin Download Monitor 3.3.5.9 - Cross-Site...

4.3CVSS5.9AI score0.10456EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.40 views

WordPress Integrator 1.32 - Cross-Site Scripting

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. id: CVE-2012-5913 info: name: WordPress Integrator 1.32 - Cross-Site Scripti...

4.3CVSS5.9AI score0.08693EPSS
SaveExploits2References5
Rows per page
Query Builder