Lucene search
+L

138807 matches found

Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•25 views

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

7.4AI score0.68776EPSS
SaveExploits2References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•12 views

Crawl4AI < 0.8.0 - Local File Inclusion

The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes. id: CVE-2026-26217 info: name: Crawl4AI 0.8.0 - Local File Inclusion author:...

9.2CVSS5.9AI score0.02025EPSS
SaveExploits0References1
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•30 views

WordPress MapPress Maps <= 2.96.6 - Unauthenticated IDOR

MapPress Maps for WordPress = 2.96.6 contains an authorization bypass caused by missing ownership verification in REST API routes, letting unauthenticated attackers read any map data and authenticated contributors modify any map, exploit requires crafted API requests id: CVE-2026-8839 info: name:...

5.3CVSS5.8AI score0.01304EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•11 views

Read More & Accordion <= 3.5.7 - Authenticated Privilege Escalation

The Read More & Accordion expand-maker plugin for WordPress through 3.5.7 allows privilege escalation due to improper validation in the importData AJAX handler yrmimportdata action. An authenticated user with plugin access can upload a crafted JSON attachment to insert arbitrary rows into WordPre...

8.8CVSS5.8AI score0.01557EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•35 views

MLflow <= 3.9.0 - Arbitrary File Read

mlflow mlflow = 3.9.0 contains a path traversal caused by bypassing source path validation via the mlflow.prompt.isprompt tag in CreateModelVersion request, letting unauthenticated remote attackers read arbitrary files. id: CVE-2026-2614 info: name: MLflow = 3.9.0 - Arbitrary File Read author:...

7.5CVSS7.5AI score0.03206EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•26 views

OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

9.3CVSS6AI score0.02612EPSS
SaveExploits0References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•125 views

Bazarr < 1.4.3 - Arbitrary File Read

Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability. id: CVE-2024-40348 info: name: Bazarr Bazarr" - 'content="Bazarr' - "window.Bazarr" condition: or internal: true - method: GET path: - "BaseURL/api/swaggerui/static/../../../../../../../../../../../../../../../../etc/pass...

8.2AI score0.08223EPSS
SaveExploits2References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•67 views

Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write

File read and write vulnerability in Apache DolphinScheduler, authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler from 3.1.0 before 3.2.2. id: CVE-2024-30188 info: name: Apache DolphinScheduler = 3.1.0, 3.2.2 Resource File Read And Write...

8.1CVSS5.8AI score0.05987EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•33 views

Mockoon < 9.2.0 - Path Traversal

Mockoon before 9.2.0 contains a path traversal and local file inclusion caused by unsafe templating of server filenames from user input, letting attackers read arbitrary files on the mock server filesystem, exploit requires crafted request. id: CVE-2025-59049 info: name: Mockoon 9.2.0 - Path...

7.5CVSS8.2AI score0.01764EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•165 views

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

9.1CVSS8AI score0.60416EPSS
SaveExploits1References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•6 views

WGDashboard < 4.3.2 - Unauthenticated File Read

WGDashboard 4.3.2 contains a path traversal vulnerability caused by improper access control, letting unauthorized attackers access the host file system without authentication. id: CVE-2026-44343 info: name: WGDashboard 4.3.2 - Unauthenticated File Read author: str4k3r severity: critical...

9.8CVSS5.9AI score0.02364EPSS
SaveExploits0References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•115 views

Gradio < 2.5.0 - Arbitrary File Read

Files on the host computer can be accessed from the Gradio interface id: CVE-2021-43831 info: name: Gradio 2.5.0 - Arbitrary File Read author: isacaya severity: high description: | Files on the host computer can be accessed from the Gradio interface impact: | An attacker would be able to view the...

7.7CVSS7.3AI score0.03794EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•64 views

OneDev.io < 11.0.9 - Arbitrary File Read

Files on the host computer can be accessed by directory traversal. id: CVE-2024-45309 info: name: OneDev.io 11.0.9 - Arbitrary File Read author: isacaya severity: high description: | Files on the host computer can be accessed by directory traversal. impact: | An attacker would be able to view the...

8.7CVSS7.5AI score0.24531EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•280 views

Sitecore Experience Platform <= 10.4 - Arbitrary File Read

An issue was discovered in Sitecore Experience Platform XP, Experience Manager XM, and Experience Commerce XC 8.0 Initial Release through 10.4 Initial Release. An unauthenticated attacker can read arbitrary files. id: CVE-2024-46938 info: name: Sitecore Experience Platform = 10.4 - Arbitrary File...

7.5CVSS5.9AI score0.46767EPSS
SaveExploits0References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•199 views

EasySpider 0.6.2 - Arbitrary File Read

A vulnerability classified as problematic was found in NaiboWang EasySpider 0.6.2 on Windows. Affected by this vulnerability is an unknown functionality of the file \EasySpider\resources\app\server.js of the component HTTP GET Request Handler. The manipulation with the input...

8.8CVSS5.7AI score0.03305EPSS
SaveExploits1References6
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•159 views

WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read

WordPress Responsive Vector Maps 6.4.2 contains an arbitrary file read vulnerability because the plugin does not have proper authorization and validation of the rvmuploadregionsfilepath parameter in the rvmimportregions AJAX action, allowing any authenticated user to read arbitrary files on the w...

6.5CVSS6.7AI score0.03063EPSS
SaveExploits2References5
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•34 views

BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure

Beward N100 H.264 VGA IP Camera M2.1.6 contains an authenticated file disclosure vulnerability caused by improper validation of the 'READ.filePath' parameter in fileread script and SendCGICMD API, letting authenticated attackers read arbitrary system files. id: CVE-2019-25246 info: name: BEWARD...

8.8CVSS6AI score0.18903EPSS
SaveExploits1References3
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•70 views

TinaCMS - Path Traversal

TinaCMS CLI 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server. id: CVE-2026-29066 info: name: TinaCMS - Path Traversal author:...

6.2CVSS6AI score0.00559EPSS
SaveExploits1References2
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•44 views

DevDojo Voyager <=1.8.0 - Arbitrary File Read

DevDojo Voyager through 1.8.0 is vulnerable to path traversal at the /admin/compass. id: CVE-2024-55415 info: name: DevDojo Voyager =1.8.0 - Arbitrary File Read author: iamnoooob,rootxharsh,pdresearch severity: high description: | DevDojo Voyager through 1.8.0 is vulnerable to path traversal at t...

8.5AI score0.15559EPSS
SaveExploits1References4
Nuclei
Nuclei
•added 2026/09/25 2:05 a.m.•22 views

Jan v0.4.12 'readFileSync' - Path Traversal

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface. id: CVE-2024-36857 info: name: Jan v0.4.12 'readFileSync' - Path Traversal author: Yusuf Amr severity: high description: | Jan v0.4.12 was discovered to contain an arbitrary file rea...

7.5CVSS5.9AI score0.02054EPSS
SaveExploits1References2
Rows per page
Query Builder