Lucene search
+L

169762 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.265 views

ZTE MF971R - Referer authentication bypass

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click. id: CVE-2021-21745 info: name: ZTE MF971R - Referer authentication bypass...

4.3CVSS6.3AI score0.55709EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.52 views

Agentejo Cockpit <0.12.0 - NoSQL Injection

Agentejo Cockpit prior to 0.12.0 is vulnerable to NoSQL Injection via the newpassword method of the Auth controller, which is responsible for displaying the user password reset form. id: CVE-2020-35848 info: name: Agentejo Cockpit 0.12.0 - NoSQL Injection author: dwisiswant0 severity: critical...

9.8CVSS8.7AI score0.74591EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.97 views

D-Link DSL 2888a - Authentication Bypass/Remote Command Execution

D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55 are vulnerable to authentication bypass issues which can lead to remote command execution. An unauthenticated attacker could bypass authentication to access authenticated pages and functionality. id: CVE-2020-24579 info: name: D-Li...

8.8CVSS8.3AI score0.09997EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.203 views

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

8.6CVSS7.4AI score0.65498EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.82 views

WordPress Time Capsule < 1.21.16 - Authentication Bypass

WordPress Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWPJSONPREFIX causes the client to be logged in as the first account on the list of administrator accounts. id: CVE-2020-8771 info: name: WordPress Time Capsule 1.21.16 - Authentication...

9.8CVSS8.7AI score0.46454EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.121 views

Harbor <=1.82.0 - Privilege Escalation

Harbor 1.7.0 through 1.8.2 is susceptible to privilege escalation via core/api/user.go, which allows allows non-admin users to create admin accounts via the POST /api/users API when Harbor is setup with DB as an authentication backend and allows user to do self-registration. id: CVE-2019-16097...

6.5CVSS5.6AI score0.22443EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.455 views

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

9.8CVSS8.8AI score0.17434EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.90 views

HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass

HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22 contains an authentication bypass vulnerability which could be remotely exploited to bypass remote authentication and possibly lead to execution of arbitrary commands, gaining...

10CVSS9.3AI score0.68293EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.85 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Highlight Row feature at /index.php?module=entities/listingtypes&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

5.4CVSS5.6AI score0.00961EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.21 views

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

5.3CVSS5.3AI score0.00934EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.90 views

ZKTeco BioTime <= 9.0.1 - Privilege Escalation

BioTime default employee credentials password 123456 allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files. id: CVE-2023-38952 info: name: ZKTeco BioTime = 9.0.1 - Privilege Escalation author: riteshs4hu severity: high...

9.8CVSS7.9AI score0.0323EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.54 views

Easy Digital Downloads - Privilege Escalation

Improper Authentication vulnerability in Easy Digital Downloads plugin allows unauth. Privilege Escalation. This issue affects Easy Digital Downloads: from 3.1 through 3.1.1.4.1. id: CVE-2023-30869 info: name: Easy Digital Downloads - Privilege Escalation author: daffainfo severity: critical...

9.8CVSS8.7AI score0.031EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.25 views

TOTOLINK/Realtek Routers - CAPTCHA Bypass

On certain TOTOLINK Realtek SDK based routers, the CAPTCHA text can be retrieved via a POST request to the boafrm/formLogin URI with the JSON payload "topicurl":"setting/getSanvas". This allows an unauthenticated attacker to bypass CAPTCHA verification, gaining unauthorized access to restricted...

9.8CVSS8.8AI score0.29557EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.39 views

Arcserve Unified Data Protection - Authentication Bypass

An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin function within wizardLogin. id: CVE-2024-0799 info: name: Arcserve Unified Data Protection -...

9.8CVSS9AI score0.04342EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.48 views

XWiki - HQL Injection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

9.3CVSS9.4AI score0.02207EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.31 views

UserPro <= 5.1.1 - Authentication Bypass

The UserPro plugin for WordPress through 5.1.1 allows authentication bypass via the userprofbconnect AJAX action. id: CVE-2023-2437 info: name: UserPro = 5.1.1 - Authentication Bypass author: intelligent-ears severity: critical description: | The UserPro plugin for WordPress through 5.1.1 allows...

9.8CVSS8.6AI score0.06801EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.59 views

QNAP Music Station < 5.4.0 - Authentication Bypass

An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later id:...

8.8CVSS5.4AI score0.01243EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.28 views

Simple File List < 6.1.13 - Reflected Cross-Site Scripting

Simple File List WordPress plugin \u003C 6.1.13 contains a reflected cross-site scripting caused by unsanitized URL output in an attribute, letting attackers execute malicious scripts in admin browsers, exploit requires victim to be an admin. id: CVE-2024-10146 info: name: Simple File List 6.1.13...

5.4CVSS5AI score0.00585EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.189 views

ThinVNC - Authentication Bypass

ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via a specific command, potentially leading to unauthorized access and code execution. id: CVE-2022-25226 info: name: ThinVNC - Authentication Bypass author: ritikchaddha severity: critical description: |...

10CVSS8.8AI score0.11027EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.115 views

Dragonfly2 < 2.1.0-beta.1 - Hardcoded JWT Secret

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

9.8CVSS5.4AI score0.33606EPSS
SaveExploits1References4
Rows per page
Query Builder