Lucene search
+L

129449 matches found

Nuclei
Nuclei
added 2026/08/26 2:49 a.m.47 views

Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting

The plugin was affected by a reflected XSS in custom-facebook-feed in cff-top admin page. id: CVE-2021-25065 info: name: Smash Balloon Social Post Feed 4.1.1 - Authenticated Reflected Cross-Site Scripting author: Harsh severity: medium description: | The plugin was affected by a reflected XSS in...

5.4CVSS5.4AI score0.01217EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.104 views

Affiliates Manager < 2.9.0 - Cross Site Scripting

The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. id: CVE-2021-25078 info: name: Affiliates Manager 2.9.0 - Cross...

6.1CVSS6AI score0.02288EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.112 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

9CVSS8.4AI score0.74979EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.221 views

FlatPress 1.2.1 - Stored Cross-Site Scripting

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks. id: CVE-2021-41432 info: name: FlatPress 1.2.1 -...

5.4CVSS5.9AI score0.01711EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.174 views

KONGA 0.14.9 - Privilege Escalation

KONGA 0.14.9 allows attackers to set higher privilege users to full administration access. The attack vector is a crafted condition, as demonstrated by the /api/user/ID at ADMIN parameter. id: CVE-2021-42192 info: name: KONGA 0.14.9 - Privilege Escalation author: rschio severity: high description...

9CVSS8AI score0.10066EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.100 views

Online Event Booking and Reservation System 2.3.0 - SQL Injection

Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS9.2AI score0.15806EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.57 views

Contact Form Entries < 1.2.4 - Cross-Site Scripting

The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...

6.1CVSS6AI score0.0682EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.98 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

9CVSS8.4AI score0.71536EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.88 views

osTicket 1.15.x - SQL Injection

A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execute arbitrary SQL commands via the "keywords" and "topicid" URL parameters combination. id: CVE-2021-45811 info: name: osTicket 1.15.x - SQL Injection author:...

6.5CVSS7AI score0.02454EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.76 views

WordPress BackupBuddy <8.8.3 - Cross Site Scripting

WordPress BackupBuddy plugin before 8.8.3 contains a cross-site vulnerability. The plugin does not sanitize and escape some parameters before outputting them back in various locations. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected...

6.1CVSS7.1AI score0.00858EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.61 views

rConfig 3.9.6 - Local File Inclusion

rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. id: CVE-2021-29006 info: name: rConfig 3.9.6 - Local File Inclusion author: r3Y3r53 severity: medium description: | rConfig 3.9.6 is affected by a Local File...

6.5CVSS6.4AI score0.05557EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.68 views

WebTareas 2.4p5 - SQL Injection

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php. id: CVE-2022-44291 info: name: WebTareas 2.4p5 - SQL Injection author: theamanrawat severity: critical description: | webTareas 2.4p5 was discovered to contain a SQL injection...

9.8CVSS9AI score0.03587EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.45 views

Microweber <1.2.11 - Information Disclosure

Microweber before 1.2.11 is susceptible to information disclosure. An error message is generated in microweber/microweber which contains sensitive information while viewing comments from loadmodule:commentssearch=. An attacker can possibly obtain sensitive information, modify data, and/or execute...

9.4CVSS8.5AI score0.06923EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.90 views

Rukovoditel <= 3.2.1 - Cross-Site Scripting

A stored cross-site scripting XSS vulnerability in the Users Access Groups feature /index.php?module=usersgroups/usersgroups of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New...

5.4CVSS5.6AI score0.00883EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.59 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add New Field function at /index.php?module=entities/fields&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name...

5.4CVSS5.5AI score0.00937EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.67 views

WordPress WP-Ban <1.69.1 - Stored Cross-Site Scripting

WordPress WP-Ban plugin before 1.69.1 contains a stored cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, which can allow high-privilege users to steal cookie-based authentication credentials and launch other attacks. This vulnerability can be...

4.8CVSS4.8AI score0.00851EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.78 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via /domain//admin/dw/add-server.php DisplayName parameters. id: CVE-2018-19892 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripti...

4.8CVSS5.3AI score0.01514EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.91 views

WordPress WPvivid Backup <0.9.76 - Local File Inclusion

WordPress WPvivid Backup version 0.9.76 is vulnerable to local file inclusion because the plugin does not sanitize and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server. id: CVE-2022-2863 info: name: WordPress...

4.9CVSS5.1AI score0.20668EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.36 views

Enigma NMS < 65.0.0 - Authenticated OS Command Injection

An OS command injection vulnerability in the discoverandmanage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an authenticated attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ipaddress variable within an snmpbrowser action. id:...

10CVSS9.3AI score0.25853EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/08/26 2:49 a.m.74 views

WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection

WordPress Paytm Payment Gateway plugin through 2.7.3 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-45805 info: name: WordPress Payt...

9.8CVSS9.2AI score0.02327EPSS
SaveExploits0References5
Rows per page
Query Builder