Lucene search
+L

6706 matches found

Nuclei
Nuclei
added 2026/08/25 6:03 a.m.44 views

EyesOfNetwork - Hardcoded API Key

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key hardcoded as EONAPIKEY in include/apifunctions.php for API version 2.4.2 by default for all installations, hence allowing an attacker to calculate/guess the admin access token. id: CVE-2020-8657 info: name:...

9.8CVSS8.6AI score0.91874EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.462 views

MantisBT <=2.30 - Arbitrary Password Reset/Admin Access

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirmhash value to verify.php. id: CVE-2017-7615 THIS TEMPLATE IS ONLY FOR DETECTING To carry out further attacks, please see reference2 below. This template works by guessing user ID. MantisBT...

8.8CVSS8.3AI score0.90856EPSS
SaveExploits10
Cvelist
Cvelist
added 2026/08/25 5:31 a.m.42 views

CVE-2026-78477 Jawn <= 1.4.2 - Unauthenticated Privilege Escalation

The Jawn theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This makes it possible for unauthenticated attackers to elevate their privileges to that of an administrator...

9.8CVSS0.003EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/08/25 4:51 a.m.7 views

CVE-2025-63820

CVE-2025-63820 Einreicher: Nicola Giuffrida Informationen Hersteller: TOTOLINK Website des Herstellers: TOTOLINK Modell: A720R Firmware-Version: V4.1.5cu.630B20250509 Firmware-Downloadadresse: TOTOLINK Details zur Schwachstelle Beim Anmelden am Kontrollpanel werden Benutzername und Passwort im...

5.4AI score
SaveExploits0
Kitploit
Kitploit
added 2026/08/25 4:47 a.m.3 views

CVE-2023-3460

Ultimate Member - Panoramica Benvenuti nel repository GitHub di Ultimate Member! Ultimate Member è un potente e flessibile plugin per profili utente e iscrizioni per WordPress, ma a volte i plugin presentano alcune vulnerabilità e portano al compromesso del sito web. Avviso importante: si prega d...

9.8CVSS9AI score0.72306EPSS
SaveExploits12
Cvelist
Cvelist
added 2026/08/25 3:27 a.m.37 views

CVE-2026-14280 Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.3.7.4 via the emoptionssave function. This makes it possible for authenticated attackers, with administrator-level access and above, to...

6.6CVSS0.0071EPSS
SaveExploits0References10
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.12 views

PT-2026-81273

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

4.9CVSS5.8AI score0.00301EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.10 views

PT-2026-81177

Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.4.3 Description An issue exists that allows unauthenticated attackers to elevate their privileges to those of an administrator. Recommendations Update Jawn to a version newer than 1.4.2...

9.8CVSS5.2AI score0.003EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/08/24 10:34 p.m.2 views

Apache-HTTP-Server-Vulnerabilities-CVE-2021-41773-and-CVE-2021-42013

Ricognizione e Sfruttamento: Vulnerabilità del Server HTTP Apache - CVE-2021-41773 e CVE-2021-42013 In questo progetto, ho documentato un processo dettagliato di penetration testing mirato alle vulnerabilità del server HTTP Apache, in particolare CVE-2021-41773 e CVE-2021-42013, che coinvolgono...

9.8CVSS8.7AI score0.99992EPSS
SaveExploits190
Kitploit
Kitploit
added 2026/08/24 7:42 p.m.5 views

CVE-2025-34077

CVE-2025-34077 Dirottamento di sessione admin non autenticato - Plugin Pie Register ≤ 3.7.1.4 📌 Descrizione Questo exploit sfrutta una vulnerabilità nel plugin Pie Register per WordPress versioni ≤ 3.7.1.4, consentendo il dirottamento di sessione non autenticato di account admin. 🛡️ Questo...

10CVSS8.7AI score0.09903EPSS
SaveExploits7References2
Tenable Nessus
Tenable Nessus
added 2026/08/21 12:00 a.m.10 views

Linux Distros Unpatched Vulnerability : CVE-2026-77648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from t...

2.2CVSS5.5AI score0.00192EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/20 11:16 p.m.9 views

CVE-2026-77648

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

2.2CVSS0.00192EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 6:40 p.m.23 views

EUVD-2026-41148

Wagtail: Improper permission handling in image preview...

6.5CVSS5.2AI score0.0034EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 6:40 p.m.7 views

GHSA-R6P4-GRQ7-XM4M Wagtail: Improper permission handling in image preview

Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...

6.5CVSS5.7AI score0.0034EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/20 6:40 p.m.18 views

EUVD-2026-41147

Wagtail: Improper restriction handling on Documents and Images chosen endpoints...

4.3CVSS5.2AI score0.0027EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/20 12:00 a.m.13 views

PT-2026-79269

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import filtering opts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and ...

2.2CVSS5.3AI score0.00192EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/08/19 6:36 p.m.8 views

CVE-2026-18681 This Power System Buffer Overflow

IBM Server Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the FSP firmware update process. An attacker with authenticated administrator-level access to the FSP can, under specific conditions, execute...

6.8CVSS5.7AI score0.00201EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/19 6:16 p.m.7 views

CVE-2025-14600

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

9.3CVSS0.00374EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/19 5:39 p.m.12 views

EUVD-2025-210742

An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account...

9.3CVSS6AI score0.00374EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/19 3:36 p.m.31 views

CVE-2026-62666 Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey, generate2fa, and disable2fa omit the accessGrantsSuper target check used by sibling user mutation endpoints. A non-super account...

8.8CVSS0.00426EPSS
SaveExploits0References3
Rows per page
Query Builder