Lucene search
+L

632554 matches found

Nuclei
Nuclei
added 2026/09/24 2:06 a.m.39 views

JFrog Artifactory Access Blank Join Key Authentication Bypass

JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. id: CVE-2026-82329 info: name: JFrog Artifactory Access Blank Join Key Authentication Bypass author: johnk3r,pruv...

9.8CVSS6.2AI score0.14121EPSS
SaveExploits8References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.42 views

LiquidFiles < 4.2 - User Enumeration via Password Reset

LiquidFiles filetransfer server before 4.2 contains a user enumeration vulnerability caused by distinguishable responses in password reset functionality, letting unauthenticated attackers enumerate valid user accounts, exploit requires no authentication. id: CVE-2025-56132 info: name: LiquidFiles...

5.8AI score0.00695EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.57 views

LearnPress < 4.2.7.1 - SQL Injection

The LearnPress WordPress LMS Plugin before 4.2.7.1 is vulnerable to unauthenticated SQL injection via the 'cfields' parameter in the /wp-json/lp/v1/courses/archive-course REST API endpoint, allowing attackers to extract sensitive information from the database. id: CVE-2024-8529 info: name:...

10CVSS5.8AI score0.12056EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.242 views

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

8.6CVSS7.2AI score0.65717EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.22 views

Pinger 1.0 - Remote Code Execution

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters. id:...

9.8CVSS6.5AI score0.03204EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.53 views

Mitel MiCollab <= 9.8.0.33 - SQL Injection

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

9.1CVSS8.3AI score0.9811EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.42 views

Spring Cloud Gateway Server Webflux - Broken Access Control

Spring Cloud Gateway Server Webflux contains a vulnerability caused by unsecured and exposed actuator endpoints allowing modification of Spring Environment properties, letting attackers modify configuration, exploit requires unsecured actuator endpoints exposure. id: CVE-2025-41243 info: name:...

10CVSS8.2AI score0.03548EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.91 views

Horde Groupware Unauthenticated Admin Access

Horde Groupware contains an administrative account with a blank password, which allows remote attackers to gain access. id: CVE-2005-3344 info: name: Horde Groupware Unauthenticated Admin Access author: pikpikcu severity: critical description: Horde Groupware contains an administrative account wi...

10CVSS5.8AI score0.07986EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.61 views

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

5.9CVSS6.5AI score0.02054EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.34 views

Mitel 6000 - OS Command Injection

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

8.3AI score0.50237EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.49 views

ICTBroadcast - Command Injection

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are know...

9.3CVSS7.8AI score0.05661EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.124 views

WordPress WPQA <5.5 - Improper Access Control

WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. id: CVE-2022-1598 info: name: WordPress WPQA 5.5 - Improper Access Control...

5.3CVSS6AI score0.05383EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.130 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/takeaction.php?id=. id: CVE-2022-31984 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL...

7.2CVSS7.2AI score0.04906EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.53 views

Easy!Appointments <1.4.3 - Broken Access Control

Easy!Appointments prior to 1.4.3 allows exposure of Private Personal Information to an unauthorized actor via the GitHub repository alextselegidis/easyappointments. id: CVE-2022-0482 info: name: Easy!Appointments 1.4.3 - Broken Access Control author: francescocarlucci,opencirt severity: critical...

9.1CVSS8.1AI score0.43746EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.91 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=reports&date=. id: CVE-2022-31974 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL Injectio...

7.2CVSS7.2AI score0.05042EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.38 views

Icinga Web 2 - Arbitrary File Disclosure

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. id: CVE-2022-24716 info:...

7.5CVSS7.2AI score0.89378EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.84 views

Hospital Management System 1.0 - SQL Injection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/doctor.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

9.8CVSS8.3AI score0.07749EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.23 views

NotificationX Dropshipping < 4.4 - SQL Injection

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection id: CVE-2022-3481 info: name: NotificationX Dropshipping 4.4 - SQL Injection author: ritikchaddha severity: critical...

9.8CVSS8.2AI score0.03947EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.100 views

Lansweeper Unauthenticated SQL Injection

Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. id: CVE-2019-13462 info: name: Lansweeper Unauthenticated SQL Injection author: divyamudgal severity: critical description: Lansweeper before 7.1.117.4 allows unauthenticated SQL injection. impact: | This vulnerability can lead to...

9.1CVSS8.2AI score0.1131EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/24 2:06 a.m.38 views

VMware Workspace ONE Access - Authentication Bypass

VMware Workspace ONE Access has two authentication bypass vulnerabilities CVE-2022-22955 & CVE-2022-22956 in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework. id: CVE-2022-22956...

9.8CVSS8.4AI score0.49814EPSS
SaveExploits5References4
Rows per page
Query Builder