Lucene search
+L

473569 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.40 views

ChurchCRM - API Authentication Bypass via URL Injection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public id: CVE-2026-39339 info: name:...

9.1CVSS5.2AI score0.01351EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.38 views

Django RasterField - SQL Injection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. id: CVE-2026-1207 info: name: Django RasterField - SQL Injection author: omarkurt...

8.3CVSS6.9AI score0.12976EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.25 views

XStore Theme < 9.7.3 - SQL Injection

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection id: CVE-2026-3326 info: name: XStore Theme 9.7.3 - SQL Injection author: VixianSchool...

8.6CVSS5.7AI score0.01866EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.25 views

Gotenberg - Command Injection

Gotenberg 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request. id: CVE-2026-42589 info: name: Gotenberg - Command Injection...

9.8CVSS8.7AI score0.03013EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.128 views

WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection

The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

9.8CVSS5.9AI score0.02996EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.80 views

LDAP Injection In OpenAM

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration ca...

7.5CVSS7.3AI score0.76385EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.152 views

PrestaShop SmartBlog <4.0.6 - SQL Injection

PrestaShop SmartBlog by SmartDataSoft 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality. id: CVE-2021-37538 info: name: PrestaShop SmartBlog 4.0.6 - SQL Injection author: whoever severity: critical description: PrestaShop SmartBlog by SmartDataSoft 4.0.6 is...

9.8CVSS9.1AI score0.74489EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.67 views

Download Monitor < 4.4.5 - SQL Injection

The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...

7.2CVSS7.3AI score0.17348EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.43 views

WordPress RSVPMaker <=9.3.2 - SQL Injection

WordPress RSVPMaker plugin through 9.3.2 contains a SQL injection vulnerability due to insufficient escaping and parameterization on user-supplied data passed to multiple SQL queries in /rsvpmaker-email.php. An attacker can possibly obtain sensitive information, modify data, and/or execute...

9.8CVSS8.3AI score0.12776EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.89 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=. id: CVE-2022-31974 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL Injectio...

7.2CVSS7.6AI score0.04947EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.43 views

WordPress E2Pdf <1.16.45 - Cross-Site Scripting

WordPress E2Pdf plugin before 1.16.45 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, even when the unfilteredhtml capability is disallowed. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context o...

4.8CVSS5.1AI score0.01262EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter. id: CVE-2021-40969 info: name: Spotweb = 1.5.1 - Cross Site Scripting Reflected author: theamanrawat...

6.1CVSS6.2AI score0.02239EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.121 views

Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php. This in turn can lead to remot...

9CVSS8.4AI score0.56384EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.72 views

Pie Register < 3.7.1.6 - SQL Injection

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection. id:...

9.8CVSS9.1AI score0.06566EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.244 views

Ghost CMS Content API - SQL Injection

Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload. id: CVE-2026-26980 info: name: Ghost CMS Content API - SQL Injection author:...

9.4CVSS9.3AI score0.70208EPSS
SaveExploits8References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.204 views

Fortinet FortiSandbox - Command Injection

Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input. id: CVE-2026-39808 info: name: Fortinet FortiSandbox - Command...

9.8CVSS9.1AI score0.92819EPSS
SaveExploits7References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.58 views

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

9.8CVSS9.6AI score0.97789EPSS
SaveExploits76References6
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.93 views

rConfig 3.9.4 - SQL Injection

rConfig 3.9.4 and previous versions has unauthenticated compliancepolicyelements.inc.php SQL injection. Because nodes' passwords are stored by default in cleartext, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. id: CVE-2020-10547 info: nam...

9.8CVSS9AI score0.33266EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.30 views

WordPress Page Layout builder v1.9.3 - Cross-Site Scripting

WordPress plugin Page-layout-builder v1.9.3 contains a cross-site scripting vulnerability. id: CVE-2016-1000141 info: name: WordPress Page Layout builder v1.9.3 - Cross-Site Scripting author: daffainfo severity: medium description: WordPress plugin Page-layout-builder v1.9.3 contains a cross-site...

6.1CVSS5.6AI score0.03462EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.81 views

F5 BIG-IP Appliance Mode - Command Injection

When running in Appliance mode, an authenticated user assigned the Administrator role may bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. id: CVE-2022-41800 info: name: F5 BIG-IP Appliance Mode - Command Injection author: dwisiswant0 severity: high description...

9.8CVSS8.9AI score0.99958EPSS
SaveExploits68References5
Rows per page
Query Builder