Lucene search
+L

263282 matches found

Nuclei
Nuclei
added 2026/08/24 5:53 a.m.40 views

Joomla! Harmis Messenger 1.2.2 - Local File Inclusion

Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files. id: CVE-2019-9922 info: name: Joomla! Harmis Messenger 1.2.2 - Local File Inclusion author: 0xAkoko severity: high description: Joomla! Harmis Messenger 1.2.2 is...

7.5CVSS6.5AI score0.1059EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.122 views

Apache Airflow OS Command Injection

Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. id: CVE-2022-24288 info: name: Apache Airflow OS Command Injection...

8.8CVSS8.2AI score0.7788EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.165 views

Apache Struts2 S2-062 - Remote Code Execution

Apache Struts2 S2-062 is vulnerable to remote code execution. The fix issued for CVE-2020-17530 S2-061 was incomplete, meaning some of the tag's attributes could still perform a double evaluation if a developer applied forced OGNL evaluation by using the %... syntax. id: CVE-2021-31805 info: name...

9.8CVSS8.2AI score0.95931EPSS
SaveExploits17References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.131 views

NodeBB XML-RPC Request xmlrpc.php - XML Injection

A remote code execution RCE vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers to execute arbitrary code via crafted XML-RPC requests. id: CVE-2023-43187 info: name: NodeBB XML-RPC Request xmlrpc.php - XML Injection author: 0xParth...

9.8CVSS9.9AI score0.45401EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.345 views

Ncast busiFacade - Remote Command Execution

The Ncast Yingshi high-definition intelligent recording and playback system is a newly developed audio and video recording and playback system. The system has RCE vulnerabilities in versions 2017 and earlier. id: CVE-2024-0305 info: name: Ncast busiFacade - Remote Command Execution author: BMCel...

7.5CVSS6.5AI score0.66932EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.360 views

Chamilo LMS <= v1.11.20 Unauthenticated Command Injection

Command injection in /main/webservices/additionalwebservices.php in Chamilo LMS = v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. id: CVE-2023-3368 info: name: Chamilo LMS = v1.11.20 Unauthenticated Command Injection...

9.8CVSS9.2AI score0.69671EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.142 views

Viessmann Vitogate 300 - Remote Code Execution

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. id: CVE-2023-45852 info: name: Viessmann Vitogate 300 - Remote Code Execution autho...

9.8CVSS7.6AI score0.14003EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.29 views

TitanNit Web Control 2.01/Atemio 7600 - Remote Code Execution

The device contains a command injection caused by the 'getcommand' query in the application, letting unauthorized attackers execute system commands with root privileges, exploit requires attacker to send crafted requests. id: CVE-2024-9166 info: name: TitanNit Web Control 2.01/Atemio 7600 - Remot...

9.3CVSS5.4AI score0.01578EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.71 views

FreePBX - Remote Code Execution

FreePBX 15, 16, and 17 contain a remote code execution caused by insufficiently sanitized user-supplied data in endpoints, letting unauthenticated attackers manipulate the database and execute code remotely, exploit requires no authentication. id: CVE-2025-57819 info: name: FreePBX - Remote Code...

10CVSS9.8AI score0.88269EPSS
SaveExploits27References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.178 views

NestJS DevTools Integration - Remote Code Execution

Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution RCE vulnerability was discovered in the @nestjs/devtools-integration package. When enabled, the package exposes a local development HTTP server with an API...

9.4CVSS9.6AI score0.49994EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.105 views

ThemeREX Addons - Remote Code Execution

ThemeREX Addons plugin before 2020-03-09 for WordPress contains an access control vulnerability in the /trxaddons/v2/get/sclayout REST API endpoint, allowing any users to execute PHP functions because includes/plugin.rest-api.php calls trxaddonsrestgetsclayout with an unsafe sc parameter, letting...

9.8CVSS9.1AI score0.08877EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.40 views

WooCommerce Help Scout - Arbitrary File Upload

WooCommerce Help Scout plugin before version 2.9.1 contains an unrestricted file upload vulnerability. The vulnerability allows unauthenticated users to upload arbitrary files to the server which by default will end up in wp-content/uploads/hstmp/ directory, potentially leading to remote code...

9.8CVSS9.2AI score0.07908EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.8 views

WP SuperBackup <= 2.3.3 - Unauthenticated Arbitrary File Upload to RCE

The Super Backup & Clone - Migrate for WordPress plugin indeed-wp-superbackup is vulnerable to arbitrary file uploads due to missing file type validation and a missing capability check on the ibkrestoremigratecheck function in all versions up to and including 2.3.3. Unauthenticated attackers can...

10CVSS9.4AI score0.29994EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.24 views

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

8.8CVSS5.9AI score0.3436EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.34 views

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28480 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

10CVSS9.8AI score0.83214EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.69 views

Acmailer - Improper Access Control to OS Command Injection

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified...

10CVSS9.1AI score0.07871EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.78 views

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

9.8CVSS9.8AI score0.19083EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.55 views

Melis Technology Melis Platform - Unrestricted File Upload & Remote Code Execution

Melis Technology Melis Platform contains an unrestricted file upload caused by insufficient validation of 'mcsdetailimg' parameter in /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm, letting attackers upload malicious files and achieve remote code execution, exploit requires crafted...

9.3CVSS5.6AI score0.02482EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.18 views

SPIP Saisies - Remote Code Execution

SPIP Saisies plugin 5.4.0 through 5.11.0 contains a remote code execution caused by an unspecified flaw, letting attackers execute arbitrary code on the server, exploit requires no special conditions. id: CVE-2025-71243 info: name: SPIP Saisies - Remote Code Execution author: omarkurt severity:...

9.8CVSS6.7AI score0.05126EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/24 5:53 a.m.31 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS9.7AI score0.53936EPSS
SaveExploits8References5
Rows per page
Query Builder