Lucene search
+L

473536 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.67 views

Download Monitor < 4.4.5 - SQL Injection

The Download Monitor plugin for WordPress is vulnerable to SQL injection via the 'orderby' parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attacker...

7.2CVSS7.3AI score0.17348EPSS
SaveExploits5References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.43 views

WordPress RSVPMaker <=9.3.2 - SQL Injection

WordPress RSVPMaker plugin through 9.3.2 contains a SQL injection vulnerability due to insufficient escaping and parameterization on user-supplied data passed to multiple SQL queries in /rsvpmaker-email.php. An attacker can possibly obtain sensitive information, modify data, and/or execute...

9.8CVSS8.3AI score0.12776EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.89 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=. id: CVE-2022-31974 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL Injectio...

7.2CVSS7.6AI score0.04947EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.43 views

WordPress E2Pdf <1.16.45 - Cross-Site Scripting

WordPress E2Pdf plugin before 1.16.45 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape some of its settings, even when the unfilteredhtml capability is disallowed. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context o...

4.8CVSS5.1AI score0.01262EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected)

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter. id: CVE-2021-40969 info: name: Spotweb = 1.5.1 - Cross Site Scripting Reflected author: theamanrawat...

6.1CVSS6.2AI score0.02239EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.121 views

Nagios 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php. This in turn can lead to remot...

9CVSS8.4AI score0.56384EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.72 views

Pie Register < 3.7.1.6 - SQL Injection

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it in a SQL statement in the wp-json/pie/v1/login REST API endpoint, leading to an SQL injection. id:...

9.8CVSS9.1AI score0.06566EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.243 views

Ghost CMS Content API - SQL Injection

Ghost CMS before 6.19.1 is vulnerable to a blind SQL injection in the /ghost/api/content/tags/ endpoint via the filter parameter. This template checks for the vulnerability by sending a boolean-based payload. id: CVE-2026-26980 info: name: Ghost CMS Content API - SQL Injection author:...

9.4CVSS9.3AI score0.70208EPSS
SaveExploits8References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.204 views

Fortinet FortiSandbox - Command Injection

Fortinet FortiSandbox 4.4.0 through 4.4.8 contains a command injection caused by improper neutralization of special elements in OS commands, letting attackers execute unauthorized code or commands, exploit requires crafted input. id: CVE-2026-39808 info: name: Fortinet FortiSandbox - Command...

9.8CVSS9.1AI score0.92819EPSS
SaveExploits7References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.6 views

LB-LINK Routers - Unauthenticated Command Injection

LB-LINK X-PRO 1.0.22-20231206 contains a hardcoded credentials vulnerability caused by manipulation of an unknown function in /etc/shadow, letting remote attackers use hardcoded credentials, exploit requires high complexity id: CVE-2026-19900 info: name: LB-LINK Routers - Unauthenticated Command...

9.2CVSS7.8AI score0.02243EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.58 views

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

9.8CVSS9.6AI score0.97789EPSS
SaveExploits76References6
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.64 views

Code-Projects School Fees Payment System 1.0 - SQL Injection

A vulnerability was found in code-projects School Fees Payment System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been...

9.8CVSS7AI score0.01754EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.22 views

Loan Management System 1.0 - SQL Injection

Loan Management System 1.0 contains a SQL injection vulnerability via the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id: CVE-2025-9744 info: name:...

9.8CVSS7.7AI score0.01806EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.21 views

MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

8.8CVSS5.5AI score0.02098EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.12 views

Dahua EIMS - Unauthenticated Remote Code Execution via capture_handle

A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capturehandle.action interface. The flaw stems from improper input validation in the captureCommand parameter, which is processed without...

10CVSS6AI score0.14607EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.18 views

Apache Tika - XXE Injection

Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE via malicious XFA in PDFs, allowing file read and SSRF attacks. id: CVE-2025-54988 info: name: Apache Tika - XXE Injection author: tx1ee severity: critical description: | Apache Tika versions 1.13 through 3.2.1 are vulnerable to XXE vi...

9.8CVSS8AI score0.15038EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.216 views

Cacti cmd_realtime.php - Command Injection

Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when registerargcargv option of PHP is On. In cmdrealtime.php line 119, the $pollerid used ...

10CVSS9.5AI score0.98455EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.23 views

Team WordPress Plugin (TLP Team) <= 5.0.9 - SQL Injection

Team WordPress plugin = 5.0.11 contains a SQL injection caused by improper sanitization and escaping of a parameter in an AJAX action accessible to unauthenticated users, letting remote attackers execute arbitrary SQL commands. id: CVE-2025-14124 info: name: Team WordPress Plugin TLP Team = 5.0.9...

8.6CVSS6.1AI score0.01594EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.7 views

Geo Mashup <= 1.13.18 - SQL Injection

Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...

7.5CVSS5.8AI score0.01422EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.12 views

WhatsUp Gold GetStatisticalMonitorList SQL Injection - Authentication Bypass

In WhatsUp Gold versions released before 2024.0.0, if the application is configured with only a single user, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password. id: CVE-2024-6671 info: name: WhatsUp Gold GetStatisticalMonitorList SQL Injectio...

9.8CVSS9.4AI score0.18988EPSS
SaveExploits0References3
Rows per page
Query Builder