Lucene search
+L

25214 matches found

Kitploit
Kitploit
added 2026/09/15 6:42 a.m.8 views

CVE-2024-9264-RCE-Exploit

CVE-2024-9264-RCE-Exploit in Grafana via SQL Expressions 描述 Grafana中远程代码执行(CVE-2024-9264)的概念验证 该仓库包含一个Python脚本,用于利用Grafana的SQL Expressions功能中的远程代码执行(RCE)漏洞。通过利用输入清理不足,该漏洞利用允许攻击者在服务器上执行任意shell命令。这是通过shellfs社区扩展实现的,攻击者可以安装并加载该扩展以协助命令执行。 前置条件 已验证的具有Viewer或更高权限的Grafana用户...

9.9CVSS8.1AI score0.94864EPSS
SaveExploits11
EUVD
EUVD
added 2026/09/15 6:07 a.m.5 views

EUVD-2026-78297

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...

6.4CVSS5.9AI score0.0025EPSS
SaveExploits0References16
CVE
CVE
added 2026/09/15 6:07 a.m.12 views

CVE-2026-15402

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin (slugged wp-event-solution ) is vulnerable to Stored Cross-Site Scripting (XSS) via the etn_shedule_objective schedule_slot parameter in versions up to and including 4.1.23 . The root cause is insuff...

6.4CVSS5.9AI score0.0025EPSS
SaveExploits0References16
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.44 views

WP Triggers Lite - Cross-Site Scripting

WP Triggers Lite WordPress plugin v2.5.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

7.1CVSS8.1AI score0.00571EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.9 views

Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting

The Gutenverse plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to and including 3.4.6. The issue arises due to insufficient input sanitization and output escaping in the rendercontent method of class-search-result-title.php, which outputs...

6.1CVSS6AI score0.00473EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.99 views

WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting

WordPress MF Gig Calendar plugin 1.1 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize or escape the id GET parameter before outputting back in the admin dashboard when editing an event. id: CVE-2021-24510 info: name: WordPress MF Gig Calendar =1.2 which...

6.1CVSS6.2AI score0.02721EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.92 views

osTicket < 1.12.1 - Cross-Site Scripting

An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the...

6.1CVSS6.9AI score0.10902EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.131 views

GLPI < 10.0.17 - Pre-Auth SQL Injection

A pre-authentication SQL injection vulnerability exists in the Inventory feature of GLPI. The vulnerability is caused by insufficient sanitization of user input in the handleAgent function when processing XML requests. The issue occurs because SimpleXMLElement objects can bypass the...

9.8CVSS6.3AI score0.86348EPSS
SaveExploits6References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.65 views

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

4CVSS5.3AI score0.00668EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.55 views

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

6.1CVSS6.2AI score0.01117EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.59 views

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

6.1CVSS7AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.26 views

Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting

Bulk Me Now! WordPress plugin = 2.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...

7.1CVSS8.1AI score0.00548EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.56 views

WordPress WPQA <5.4 - Cross-Site Scripting

WordPress WPQA plugin prior to 5.4 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter on its reset password form. id: CVE-2022-1597 info: name: WordPress WPQA 5.4 - Cross-Site Scripting author: veshraj severity: medium description: | WordPress WPQ...

6.1CVSS6.2AI score0.03017EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.90 views

wpForo Forum <= 2.1.8 - Cross-Site Scripting

The wpForo Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘wpforodebug’ function in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

6.1CVSS7.2AI score0.00845EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.87 views

GamiPress <= 2.8.9 - SQL Injection

GamiPress WordPress plugin version 2.8.9 and below suffers from an SQL injection vulnerability due to insufficient sanitization of user input, allowing attackers to execute arbitrary SQL commands. id: CVE-2024-13496 info: name: GamiPress = 2.8.9 - SQL Injection author: ritikchaddha severity: high...

7.5CVSS8.6AI score0.02231EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.30 views

WordPress Email Newsletter - Reflected XSS

WordPress Email Newsletter plugin through 1.1 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to cra...

5.4CVSS8.1AI score0.00708EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.161 views

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. id: CVE-2021-24407 info: name: WordPress Jannah Theme 5.4.5 - Cross-Site Scripting author: pikpikcu severity:...

6.1CVSS6.2AI score0.02591EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.5 views

Shield Security <= 21.0.8 - Unauthenticated Reflected XSS

Shield Security WordPress plugin = 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction. id: CVE-2026-0561 info: name: Shield...

6.1CVSS5.5AI score0.00503EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/15 5:39 a.m.78 views

ChurchCRM v4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-31548 info: name: ChurchCRM v4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

5.4CVSS6.3AI score0.01248EPSS
SaveExploits1References3
NVD
NVD
added 2026/09/15 1:16 a.m.7 views

CVE-2026-85657

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

5.4CVSS0.00138EPSS
SaveExploits0References2
Rows per page
Query Builder