Lucene search
+L

59496 matches found

CVE
CVE
added 2 days ago12 views

CVE-2026-16563

Affected software & version: Academy LMS WordPress plugin, prior to 3.8.3. Vulnerability: REST API used to fetch a single lesson does not verify course enrollment or lesson publication status. Impact: Subscribers (self-service student level) can disclose content of arbitrary lessons, including pa...

6.5CVSS5.6AI score0.00201EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2 days ago24 views

XWiki REST API Query - SQL Injection

A SQL injection vulnerability exists in XWiki's REST API query endpoint. An unauthenticated attacker can execute arbitrary SQL queries through the 'q' parameter by manipulating the HQL query, potentially leading to data exfiltration or system compromise. id: CVE-2025-32969 info: name: XWiki REST...

9.8CVSS8.2AI score0.77774EPSS
SaveExploits1References2
CVE
CVE
added 2 days ago14 views

CVE-2026-18584

GL.iNet: Affects E5800/E750/X2000/X3000/XE3000/XE300 devices; eSIM LPA API v1, file /sdk/v1, improper authorization due to manipulation of a function. Attack possible only from local network; vendor confirmation exists. No patch/workaround details provided in the documents.

5.4CVSS5.5AI score0.0023EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2 days ago48 views

CVE-2026-18584 GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization

A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...

5.4CVSS0.0023EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2 days ago23 views

CodeChecker <= 6.24.1 - Authentication Bypass

Authentication bypass occurs when the API URL ends with Authentication, Configuration or ServerInfo. This bypass allows superuser access to all API endpoints other than Authentication. These endpoints include the ability to add, edit, and remove products, among others. id: CVE-2024-10081 info:...

10CVSS5.5AI score0.38961EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2 days ago93 views

Open Automation Software OAS Platform V16.00.0121 - Missing Authentication

An improper authentication vulnerability exists in the REST API functionality of Open Automation Software OAS Platform V16.00.0121. A specially-crafted series of HTTP requests can lead to unauthenticated use of the REST API. An attacker can send a series of HTTP requests to trigger this...

9.4CVSS7.7AI score0.37177EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2 days ago89 views

FortiWeb - Cross Site Scripting

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. id: CVE-2021-22122 info: name:...

6.1CVSS6.1AI score0.1052EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2 days ago89 views

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

8.8CVSS8.5AI score0.99077EPSS
SaveExploits24References5
Nuclei
Nuclei
added 2 days ago173 views

Kong Admin <=2.03 - Admin API Access

Kong Admin through 2.0.3 contains an issue via docker-kong which makes the admin API port accessible on interfaces other than 127.0.0.1. id: CVE-2020-11710 info: name: Kong Admin =2.03 - Admin API Access author: pikpikcu severity: critical description: Kong Admin through 2.0.3 contains an issue v...

9.8CVSS7.7AI score0.33127EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2 days ago103 views

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

9.8CVSS8.3AI score0.96001EPSS
SaveExploits16References5
Nuclei
Nuclei
added 2 days ago17 views

Zoho ManageEngine - getUserAPIKey Authentication Bypass

Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, Firewall Analyzer, and OpUtils before 2022-07-27 through 2022-07-28 125657, 126002, 126104, and 126118 allow unauthenticated attackers to obtain a user's API key, and then access external...

7.5CVSS7.5AI score0.08206EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2 days ago45 views

WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation

The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site ...

9.8CVSS5.5AI score0.04156EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2 days ago59 views

Chamilo Command Injection

A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11. up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. id: CVE-2023-34960 info: name: Chamilo Command Injection author: DhiyaneshDK severity: critical...

9.8CVSS8.3AI score0.99192EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2 days ago12 views

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

9.9CVSS8AI score0.16017EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2 days ago99 views

WordPress Metform <=2.1.3 - Information Disclosure

WordPress Metform plugin through 2.1.3 is susceptible to information disclosure due to improper access control in the /core/forms/action.php file. An attacker can view all API keys and secrets of integrated third-party APIs such as that of PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA...

7.5CVSS7.2AI score0.08608EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2 days ago62 views

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

8.3CVSS6.7AI score0.70511EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2 days ago29 views

WordPress AI Engine Plugin - Token Exposure

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. id: CVE-2025-11749 info: name: WordPress AI Engine Plugin - Token Exposure author: 4m3rr0r severity: critical description: | Unauthenticat...

9.8CVSS7.4AI score0.74759EPSS
SaveExploits5References2
Nuclei
Nuclei
added 2 days ago71 views

Flowise <= 1.8.2 Authentication Bypass

An Authentication Bypass vulnerability exists in Flowise version 1.8.2. This could allow a remote, unauthenticated attacker to access API endpoints as an administrator and allow them to access restricted functionality. id: CVE-2024-8181 info: name: Flowise = 1.8.2 Authentication Bypass author:...

9.8CVSS5.5AI score0.42783EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2 days ago65 views

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

9.2CVSS8.3AI score0.99609EPSS
SaveExploits3References4
Positive Technologies
Positive Technologies
added 2 days ago9 views

PT-2026-67496

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

2.3CVSS5.5AI score0.00261EPSS
SaveExploits0References2
Rows per page
Query Builder