Lucene search
+L

519058 matches found

Nuclei
Nuclei
added 2026/09/07 6:34 a.m.128 views

Craft CMS < 3.3.0 - Server-Side Template Injection

Craft CMS before 3.3.0 is susceptible to server-side template injection via the SEOmatic component that could lead to remote code execution via malformed data submitted to the metacontainers controller. id: CVE-2020-9757 info: name: Craft CMS 3.3.0 - Server-Side Template Injection author:...

9.8CVSS8.3AI score0.72821EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.95 views

PHP-Fusion 9.03.50 - Remote Code Execution

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. id: CVE-2020-24949 info: name: PHP-Fusion 9.03.50 - Remote Code Execution author: geeknik severity: high description: PHP-Fusion 9.03.50...

9CVSS7.8AI score0.67516EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.109 views

NETGEAR ProSAFE Plus - Unauthenticated Remote Code Execution

NETGEAR ProSAFE Plus before 2.6.0.43 is susceptible to unauthenticated remote code execution. Any HTML page is allowed as a valid endpoint to submit POST requests, allowing debug action via the submitId and debugCmd parameters. The problem is publicly exposed in the login.html webpage, which has ...

9.8CVSS8.8AI score0.57195EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.26 views

Gridx 1.3 - Remote Code Execution

Gridx 1.3 is susceptible to remote code execution via tests/support/stores/testgridfilter.php, which allows remote attackers to execute arbitrary code via crafted values submitted to the $query parameter. id: CVE-2020-19625 info: name: Gridx 1.3 - Remote Code Execution author: geeknik severity:...

9.8CVSS8.9AI score0.13143EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.65 views

Apache Unomi <1.5.2 - Remote Code Execution

Apache Unomi allows conditions to use OGNL and MVEL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process. This vulnerability affects all versions of Apache Unomi prior to 1.5.2. id:...

9.8CVSS8AI score0.68398EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.1100 views

WordPress File Manager Plugin - Remote Code Execution

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. id: CVE-2020-25213 Uploaded file will be accessible at:-...

10CVSS8.6AI score0.97328EPSS
SaveExploits16References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.59 views

Joomla! Component Music Manager - Local File Inclusion

A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...

6.8CVSS6.1AI score0.04848EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.99 views

Microsoft SharePoint - Remote Code Execution

Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package. id: CVE-2020-16952 info: name: Microsoft SharePoint - Remote Code Execution author: dwisiswant0 severity: high description: Microsoft SharePoint is vulnerabl...

8.6CVSS7.8AI score0.71095EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.207 views

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...

10CVSS7.7AI score0.99838EPSS
SaveExploits23References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.218 views

XML-RPC Server - Remote Code Execution

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups. id: CVE-2017-11610 info: name: XML-RPC Serve...

9CVSS8.1AI score0.87378EPSS
SaveExploits10References5
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.214 views

Fastjson Insecure Deserialization - Remote Code Execution

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

10CVSS8.6AI score0.3897EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.29 views

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

9.2CVSS6.3AI score0.34629EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.100 views

WordPress Plugin Aviary Image Editor Addon For Gravity Forms 3.0 Beta - Arbitrary File Upload

Unrestricted file upload vulnerability in includes/upload.php in the Aviary Image Editor Add-on For Gravity Forms plugin 3.0 beta for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in...

9.8CVSS8.6AI score0.40595EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.24 views

Scramble Laravel - Remote Code Execution

Scramble for Laravel = 0.13.2 and = 0.13.2 and 0.13.22 contains a remote code execution caused by evaluation of user-controlled input in validation rules during documentation generation, letting remote attackers execute arbitrary PHP code, exploit requires publicly accessible documentation...

9.4CVSS8.6AI score0.0586EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.1485 views

Microsoft FrontPage Extensions - Information Disclosure

Frontpage Server Extensions allows remote attackers to determine the name of the anonymous account via an RPC POST request to shtml.dll in the /vtibin/ virtual directory. id: CVE-2000-0114 info: name: Microsoft FrontPage Extensions - Information Disclosure author: r3naissance,matejsmycka severity...

5CVSS5.9AI score0.47595EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.7 views

Red Hat JBoss - Insecure Deserialization

Red Hat JBoss Application Server 4.x, 5.x, 6.x contains an insecure deserialization vulnerability in the JMXInvokerServlet and EJBInvokerServlet HTTP Invoker endpoints. These endpoints deserialize arbitrary Java objects from unauthenticated HTTP POST requests. An attacker can send a crafted Apach...

10CVSS7.4AI score0.85562EPSS
SaveExploits8References6
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.14 views

Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges. id: CVE-2026-48939 info: name: Joomla iCagenda 3.9.10 - Unauthenticated Arbitrary File...

10CVSS6.5AI score0.19727EPSS
SaveExploits5References2
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.233 views

Seagate BlackArmor NAS - Command Injection

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the authname parameter to localhost/backupmgmt/preconnectcheck.php. id: CVE-2014-3206 info: name: Seagate BlackArmor NAS - Command Injection author: gy741...

10CVSS8.7AI score0.51014EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.199 views

ISPConfig - PHP Code Injection

An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if adminallowlangedit is enabled. id: CVE-2023-46818 info: name: ISPConfig - PHP Code Injection author: non-things severity: high description: | An issue was discovered...

7.2CVSS7.1AI score0.13784EPSS
SaveExploits14References4
Nuclei
Nuclei
added 2026/09/07 6:34 a.m.173 views

TOTOLINK A3700R - Command Injection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. id: CVE-2023-46574 info: name: TOTOLINK A3700R - Command Injection author: DhiyaneshDk severity: critical description: | An issue in...

9.8CVSS8.6AI score0.65412EPSS
SaveExploits2References5
Rows per page
Query Builder