Lucene search
+L

474297 matches found

Nuclei
Nuclei
added 2026/08/25 6:03 a.m.153 views

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

9.8CVSS9.1AI score0.89326EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.281 views

Node.js Embedded JavaScript 3.1.6 - Template Injection

Node.js Embedded JavaScript 3.1.6 is susceptible to server-side template injection via settingsview optionsoutputFunctionName, which is parsed as an internal option and overwrites the outputFunctionName option with an arbitrary OS command, which is then executed upon template compilation. id:...

9.8CVSS7.2AI score0.32808EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.273 views

WordPress Perfect Survey <1.5.2 - SQL Injection

Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the questionid GET parameter before using it in a SQL statement in the getquestion AJAX action, allowing unauthenticated users to perform SQL injection. id: CVE-2021-24762 info: name: WordPress Perfect Survey 1.5.2 - SQL...

9.8CVSS9AI score0.86782EPSS
SaveExploits7References4
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.253 views

Lighttpd 1.4.34 SQL Injection and Path Traversal

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. id: CVE-2014-2323 info: name: Lighttpd 1.4.34 SQL Injection and Path Traversal author: geeknik severity: critical...

9.8CVSS8.4AI score0.61665EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.91 views

Dasan GPON Devices - Remote Code Execution

Dasan GPON home routers are susceptible to command injection which can occur via the desthost parameter in a diagaction=ping request to a GponForm/diagForm URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html, it's quite simple to...

9.8CVSS9.2AI score0.99952EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.77 views

Haraj 3.7 - Cross-Site Scripting

Haraj 3.7 contains a cross-site scripting vulnerability in the User Upgrade Form. An attacker can inject malicious script and thus steal authentication credentials and launch other attacks. id: CVE-2022-31299 info: name: Haraj 3.7 - Cross-Site Scripting author: edoardottt severity: medium...

6.1CVSS5.8AI score0.05045EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.6 views

WGDashboard <= 4.3.2 - Authenticated OS Command Injection /etc/passwd Read

WGDashboard = 4.2.3 contains a command injection caused by multiple OS command injection points, letting authenticated attackers execute arbitrary commands as root. id: CVE-2026-15733 info: name: WGDashboard = 4.3.2 - Authenticated OS Command Injection /etc/passwd Read author: str4k3r,0xAkoko...

9.8CVSS5.6AI score0.13545EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.192 views

WordPress NotificationX <2.3.9 - SQL Injection

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nxid parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify dat...

9.8CVSS9.2AI score0.34359EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.40 views

WordPress JobWP Plugin <= 2.3.9 - SQL Injection

The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

7.5CVSS9.1AI score0.01737EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.18 views

WP Hotel Booking <= 2.0.7 - SQL Injection

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admininit, letting unauthenticated users perform SQL injections, exploit requires no authentication. id: CVE-2023-5652 info: name: WP...

9.8CVSS9AI score0.63711EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.44 views

Hongjing e-HR 2020 - SQL Injection

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...

9.8CVSS7.1AI score0.03766EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.76 views

XWiki >= 3.4-milestone-1 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as:...

9.6CVSS6.1AI score0.02182EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.48 views

SRS - Command Injection

SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerable to a drive-by command injection. id: CVE-2023-34105 info: name: SRS - Command Injection author: iamnoooob,rootxharsh,pdresearch severity: high description: | SRS's v5.0.137v5.0.156, v6.0.18v6.0.47 api-server server is vulnerab...

7.5CVSS7.5AI score0.0876EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.52 views

Subscribe to Category <= 2.7.4 - SQL Injection

The Subscribe to Category contains a sqlinjection caused by improper neutralization of special elements used in an SQL command, letting attackers execute arbitrary SQL commands, exploit requires user interaction. id: CVE-2023-32590 info: name: Subscribe to Category = 2.7.4 - SQL Injection author:...

9.3CVSS8.4AI score0.01808EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.17 views

WP Sessions Time Monitoring Full Automatic <= 1.0.8 - SQL Injection

The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to SQL Injection via request parameters in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

7.5CVSS7.8AI score0.02202EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.104 views

Fortinet FortiWLM Unauthenticated Command Injection Vulnerability

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands Successful exploitation of this vulnerability could allow an attacker to...

9.8CVSS8.9AI score0.18148EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.196 views

XWiki >= 6.2-milestone-1 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

9.6CVSS6AI score0.02377EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.87 views

WordPress WP TripAdvisor Review Slider <10.8 - Authenticated SQL Injection

WordPress WP TripAdvisor Review Slider plugin before 10.8 is susceptible to authenticated SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber. This can lead...

8.8CVSS8.3AI score0.04356EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.59 views

Bloofox v0.5.2.1 - SQL Injection

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit. id: CVE-2023-34754 info: name: Bloofox v0.5.2.1 - SQL Injection author: ritikchaddha severity: critical description: | bloofox v0.5.2.1 was...

9.8CVSS9AI score0.03449EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.200 views

Jms Blog - SQL Injection

The module Jms Blog jmsblog from Joommasters contains a Time Based SQL injection vulnerability. This module is for the PrestaShop e-commerce platform and mainly provided with joommasters PrestaShop themes id: CVE-2023-27034 info: name: Jms Blog - SQL Injection author: MaStErChO severity: critical...

9.8CVSS9.1AI score0.58743EPSS
SaveExploits0References5
Rows per page
Query Builder