Lucene search
+L

472971 matches found

Nuclei
Nuclei
added 2026/08/23 2:28 a.m.39 views

ZEROF Web Server 2.0 - SQL Injection

ZEROF Web Server 2.0 allows SQL Injection via the /HandleEvent endpoint. Attackers can exploit this vulnerability by manipulating the request parameters to execute arbitrary SQL queries. id: CVE-2022-25322 info: name: ZEROF Web Server 2.0 - SQL Injection author: daffainfo severity: critical...

9.8CVSS9.5AI score0.08346EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.121 views

NocoBase - SQL Injection

NocoBase versions prior to 2.0.39 contain a SQL injection vulnerability in the @nocobase/database package. The queryParentSQL function in eager-loading-tree.ts constructs a recursive CTE query by directly concatenating user-controlled primary key values into the SQL WHERE IN clause without...

8.8CVSS6AI score0.01875EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.22 views

Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection

Team WordPress plugin = 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands. id: CVE-2025-14124 info: name: Team WordPress Plugin TLP Team = 5.0.9...

8.6CVSS6.1AI score0.0156EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.24 views

WordPress CBX Bookmark & Favorite Plugin <= 2.0.4 - SQL Injection

CBX Bookmark & Favorite WordPress plugin = 2.0.4 contains a SQL injection caused by insufficient escaping of the 'orderby' parameter, letting authenticated attackers with Subscriber-level access extract sensitive database information id: CVE-2025-13652 info: name: WordPress CBX Bookmark & Favorit...

6.5CVSS5.6AI score0.01077EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.52 views

JS Help Desk <= 2.8.2 - SQL Injection

JS Help Desk WordPress plugin 2.8.2 contains a SQL injection caused by insufficient escaping and preparation of user-supplied values in 'js-support-ticket-token-tkstatus' cookie, letting unauthenticated attackers extract sensitive database information, exploit requires no authentication. id:...

7.5CVSS5.6AI score0.01317EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.12 views

WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6671 info: name: WhatsUp Gold GetStatisticalMonitorList SQL Injectio...

9.8CVSS9.4AI score0.14886EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS

Marcelotorres Redirect After Login plugin = 0.1.9 contains a stored cross-site scripting caused by insufficient sanitization in the login redirect parameter, letting attackers execute scripts in the context of the affected site, exploit requires admin privileges. id: CVE-2023-27624 info: name:...

5.9CVSS6.3AI score0.00619EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.64 views

XWiki <= 17.3.0 - Server-Side Template Injection (SSTI)

XWiki = 17.3.0 contains a server-side template injection caused by improper validation of Apache Velocity template code in the Administration interface HTTP Meta Info field, letting authenticated administrators execute arbitrary template logic. id: CVE-2025-51991 info: name: XWiki = 17.3.0 -...

8.8CVSS8.6AI score0.03605EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.7 views

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

7.5CVSS5.8AI score0.01003EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.12 views

Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capturehandle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without...

10CVSS6AI score0.12578EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

9.8CVSS8AI score0.09092EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.24 views

D-Link DIR-803 - Authentication Bypass

An authentication bypass vulnerability exists in D-Link DIR-803 routers firmware A1 1.04 and earlier. By manipulating the AUTHORIZEDGROUP parameter in /getcfg.php via newline injection, an attacker can retrieve XML configuration containing administrator credentials without authentication. id:...

7.5CVSS6AI score0.03991EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.87 views

sar2html <=3.2.2 Plot Parameter - Remote Code Execution

sar2html version 3.2.2 and prior contains an OS command injection vulnerability in the plot parameter of index.php. A remote, unauthenticated attacker can append shell metacharacters to the plot parameter and execute arbitrary operating system commands. id: CVE-2025-34030 info: name: sar2html...

10CVSS9.1AI score0.60298EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.75 views

74cms - ajax_street.php 'x' SQL Injection

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. id: CVE-2020-22208 info: name: 74cms - ajaxstreet.php 'x' SQL Injection author: ritikchaddha severity: critical description: | SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. impact: | Successful...

9.8CVSS7.7AI score0.10017EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.58 views

PHPGurukul Dairy Farm Shop Management System 1.0 - SQL Injection

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to SQL injection, as demonstrated by the username parameter in index.php, the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName and ProductPrice parameters in...

9.8CVSS7.4AI score0.15652EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.43 views

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

6.5CVSS6.6AI score0.01872EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.40 views

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

4.8CVSS8.3AI score0.00875EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.28 views

CyberPower - SQL Injection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. id: CVE-2024-32737 info: name: CyberPower - SQL Injection author: DhiyaneshDk severity: high description: | A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3...

7.5CVSS7.4AI score0.05408EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.129 views

MajorDoMo thumb.php - OS Command Injection

MajorDoMo aka Major Domestic Module before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager. id: CVE-2023-50917 info: name: MajorDoMo thumb.php - OS Command Injection author: DhiyaneshDK severity: critical...

9.8CVSS8.9AI score0.38007EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.19 views

MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

8.8CVSS5.5AI score0.01469EPSS
SaveExploits1References4
Rows per page
Query Builder