Lucene search
+L

169821 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.242 views

Adobe Coldfusion - Authentication Bypass

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

7.5CVSS7.6AI score0.10072EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.74 views

KubePi JwtSigKey - Admin Authentication Bypass

KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all online projects. This means that an attacker can forge any jwt token to take over the administrator account of any online project. Furthermor...

9.8CVSS8.6AI score0.69667EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.164 views

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6AI score0.03904EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.80 views

Strapi Versions <=4.5.6 - Authentication Bypass

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that...

8.2CVSS7.8AI score0.04158EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.83 views

Jenkins <=2.196 - Cookie Exposure

Jenkins through 2.196, LTS 2.176.3 and earlier prints the value of the cookie on the /whoAmI/ URL despite it being marked HttpOnly, thus making it possible to steal cookie-based authentication credentials if the URL is exposed or accessed via another cross-site scripting issue. id: CVE-2019-10405...

5.4CVSS4.6AI score0.65753EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.110 views

D-Link DIR-600M - Authentication Bypass

D-Link DIR-600M 3.02, 3.03, 3.04, and 3.06 devices can be accessed directly without authentication and lead to disclosure of information about the WAN, which can then be leveraged by an attacker to modify the data fields of the page. id: CVE-2019-13101 info: name: D-Link DIR-600M - Authentication...

9.8CVSS8.6AI score0.67091EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.26 views

FatPipe WARP/IPVPN/MPVPN - Backdoor Account

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain an account named "cmuser" with administrative privileges and no password, letting attackers gain unauthorized admin access, exploit requires no authentication. id: CVE-2021-27856 info: name: FatPipe...

9.8CVSS8.7AI score0.05598EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.94 views

Wipro Holmes Orchestrator 20.4.1 - Information Disclosure

Wipro Holmes Orchestrator 20.4.1 20.4.102112020 allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/DomainCredentialReportExcel,...

7.5CVSS7.8AI score0.53008EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.22 views

WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting

WordPress Skaut Bazar plugin before 1.3.3 contains a reflected cross-site scripting vulnerability due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file, which allows attackers to inject arbitrary web scripts. id: CVE-2021-34643 info: name: WordPress Skaut Bazar 1.3.3 - Cross-Site...

6.1CVSS6AI score0.0235EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.20 views

HP Switch - Authentication Bypass

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authentication bypass. HPE has made the following software updates to resolve the vulnerability in...

9.8CVSS8.2AI score0.02641EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.201 views

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...

7.5CVSS7.7AI score0.51653EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28481 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

10CVSS9.6AI score0.83214EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.186 views

Tenda AC1200 V-W15Ev2 - Authentication Bypass

The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...

4.9CVSS5.2AI score0.28802EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.22 views

FOGProject <= 1.5.10.1673 - Authentication Bypass

FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database informatio...

9.9CVSS5.4AI score0.18687EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.33 views

ETQ Reliance - Authentication Bypass via Trailing Space

An authentication bypass vulnerability exists in ETQ Reliance on the CG legacy platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login pag...

9.3CVSS6.7AI score0.31157EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.34 views

Teleport - Authentication Bypass

Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems. id: CVE-2025-49825 info: name: Teleport - Authentication Bypass author: pdteam severity: critical description: | Teleport...

9.8CVSS6.2AI score0.07804EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.101 views

Magento Mass Importer <0.7.24 - Remote Auth Bypass

Magento Mass Importer aka MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. id: CVE-2020-5777 info: name: Magento Mass Importer 0.7.24 - Remote Auth Bypass author: dwisiswant0...

9.8CVSS8.8AI score0.23303EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.205 views

SAP Solution Manager 7.2 - Remote Command Execution

SAP Solution Manager SolMan running version 7.2 has a remote command execution vulnerability within the SAP EEM servlet tcsmdagentapplicationeem. The vulnerability occurs due to missing authentication checks when submitting SOAP requests to the /EemAdminService/EemAdmin page to get information...

10CVSS9.4AI score0.98266EPSS
SaveExploits7References7
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.86 views

Vue Vben Admin - Default Credentials

Vue Vben Admin 2.10.1 contains a broken authentication caused by hardcoded credentials in the backend, letting attackers log in without proper authorization, exploit requires access to the login interface. id: CVE-2025-25570 info: name: Vue Vben Admin - Default Credentials author: 0xAkoko severit...

9.8CVSS9AI score0.02021EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.90 views

WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting

WordPress WOOCS plugin before 1.3.7.5 is susceptible to cross-site scripting. The plugin does not sanitize and escape the woocsinordercurrency parameter of the woocsgetproductspricehtml AJAX action, available to both unauthenticated and authenticated users, before outputting it back in the...

6.1CVSS5.8AI score0.01752EPSS
SaveExploits2References5
Rows per page
Query Builder