Lucene search
+L

259632 matches found

Nuclei
Nuclei
added 4 days ago243 views

Calibre <= 7.14.0 Remote Code Execution

Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

9.8CVSS8.5AI score0.84116EPSS
SaveExploits8References1
Nuclei
Nuclei
added 4 days ago106 views

The School Management < 9.9.7 - Remote Code Execution

The School Management plugin before version 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. id: CVE-2022-1609 info: name: The School Management 9.9.7 -...

9.8CVSS8.4AI score0.64321EPSS
SaveExploits6References5
Nuclei
Nuclei
added 4 days ago50 views

pgAdmin < 6.17 - Unauthenticated Remote Code Execution

pgAdmin prior to 6.17 contains an insecure HTTP API caused by improper access control, letting unauthenticated users execute arbitrary external utilities via path manipulation, exploit requires no authentication. id: CVE-2022-4223 info: name: pgAdmin 6.17 - Unauthenticated Remote Code Execution...

8.8CVSS7.9AI score0.79933EPSS
SaveExploits0References2
Nuclei
Nuclei
added 4 days ago62 views

XStream <1.4.6/1.4.10 - Remote Code Execution

Xstream API before 1.4.6 and 1.4.10 is susceptible to remote code execution. If the security framework has not been initialized, an attacker can run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. This can allow an attacker to...

9.8CVSS8AI score0.84362EPSS
SaveExploits5References5
Nuclei
Nuclei
added 4 days ago179 views

Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. id: CVE-2016-4437 info: name: Apache Shiro 1.2.4 Cookie RememberME -...

9.8CVSS7.8AI score0.93039EPSS
SaveExploits9References5
Nuclei
Nuclei
added 4 days ago158 views

Ivanti EPM - Remote Code Execution

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. id: CVE-2024-29824 info: name: Ivanti EPM - Remote Code Execution author: DhiyaneshDK severity: critical description: | ...

9.6CVSS8.6AI score0.99951EPSS
SaveExploits5References4
Nuclei
Nuclei
added 4 days ago58 views

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

9.8CVSS8.7AI score0.77951EPSS
SaveExploits5References2
Nuclei
Nuclei
added 4 days ago22 views

VMware vRealize Log Insight - Improper Access Control to RCE

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. id: CVE-2022-31704 info: name: VMware vRealize Log Insight - Improper Acces...

9.8CVSS8.3AI score0.81011EPSS
SaveExploits3References3
Nuclei
Nuclei
added 4 days ago148 views

Webmin <1.990 - Improper Access Control

Webmin before 1.990 is susceptible to improper access control in GitHub repository webmin/webmin. This in turn can lead to remote code execution, by which an attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without enterin...

9CVSS7.8AI score0.96977EPSS
SaveExploits13References5
Nuclei
Nuclei
added 4 days ago44 views

Oracle Identity Manager REST WebServices - Authentication Bypass

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

9.8CVSS7.6AI score0.88312EPSS
SaveExploits1
Nuclei
Nuclei
added 4 days ago57 views

Drupal - Remote Code Execution

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. id: CVE-2018-7600 info: name: Drupal - Remote Code Execution author:...

9.8CVSS8.1AI score0.99995EPSS
SaveExploits47References5
NVD
NVD
added 4 days ago13 views

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

8.1CVSS0.0051EPSS
SaveExploits0References2
NVD
NVD
added 4 days ago18 views

CVE-2026-15991

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

8.8CVSS0.00606EPSS
SaveExploits0References9
ATTACKERKB
ATTACKERKB
added 4 days ago11 views

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

8.1CVSS5.7AI score0.0051EPSS
SaveExploits0References3
CVE
CVE
added 4 days ago66 views

CVE-2026-15459

The CVE-2026-15459 entry concerns the WPMU DEV Dashboard WordPress plugin (

8.1CVSS5.7AI score0.0051EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago31 views

CVE-2026-15459 WPMU DEV Dashboard <= 5.0.0 - Authentication Bypass to Arbitrary Plugin Installation (Remote Code Execution) via Forged WDP_AUTH HMAC on ?wpmudev-hub= Endpoint

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

8.1CVSS0.0051EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago9 views

EUVD-2026-53710

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

8.1CVSS5.7AI score0.0051EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago11 views

EUVD-2026-53703

The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versions from 6.0 - 6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to read and delete arbitrar...

8.8CVSS6.5AI score0.00606EPSS
SaveExploits0References9
Nuclei
Nuclei
added 4 days ago276 views

ManageEngine Desktop Central Java Deserialization

Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution. id: CVE-2020-10189 info: name: ManageEngine Desktop Central Java Deserialization author: king-alexander severity: critical description: | Zoho ManageEngine...

10CVSS8.4AI score0.99941EPSS
SaveExploits6References5
Nuclei
Nuclei
added 4 days ago28 views

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. id: CVE-2018-15811 info: name: DotNetNuke...

7.5CVSS7.5AI score0.74048EPSS
SaveExploits5References4
Rows per page
Query Builder