Lucene search
+L

1131676 matches found

Nuclei
Nuclei
added 2026/08/28 4:35 a.m.19 views

Pinger 1.0 - Remote Code Execution

Pinger 1.0 contains a remote code execution vulnerability that allows attackers to inject shell commands through the ping and socket parameters. Attackers can exploit the unsanitized input in ping.php to write arbitrary PHP files and execute system commands by appending shell metacharacters. id:...

9.8CVSS6.5AI score0.03135EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.48 views

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

8.7CVSS7.3AI score0.04028EPSS
SaveExploits29References5
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.31 views

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

9.8CVSS6.2AI score0.03484EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.132 views

WordPress Booking Calendar <3.2.2 - Arbitrary File Upload

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify...

9.8CVSS7.6AI score0.04493EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.25 views

Pandora FMS <=7.0NG.722 - Remote Code Execution

Pandora FMS versions =7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload CVE-2018-11221 and a local file inclusion CVE-2018-11222. An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of t...

9.8CVSS7.6AI score0.03314EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.73 views

BIQS IT Biqs-drive v1.83 Local File Inclusion

A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user. id: CVE-2021-394...

7.5CVSS7.2AI score0.08687EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.30 views

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzzfile.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter, exploit requires attacker to send malicious URL and...

9.8CVSS7.9AI score0.03153EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.40 views

vBulletin 5.0.0-6.0.3 - Authentication Bypass

vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 contain an authentication bypass caused by unauthenticated access to protected API controllers on PHP 8.1 or later, letting unauthenticated attackers invoke protected methods remotely.Starting from PHP 8.1, due to an internal adjustment to...

10CVSS7.4AI score0.75844EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.154 views

Online Piggery Management System v1.0 - Unauthenticated File Upload

Online Piggery Management System 1.0 is vulnerable to File Upload. An unauthenticated user can upload a php file by sending a POST request to add-pig.php. id: CVE-2023-37629 info: name: Online Piggery Management System v1.0 - Unauthenticated File Upload author: Harsh severity: critical descriptio...

9.8CVSS7.3AI score0.23311EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.1033 views

WordPress Elementor 3.18.1 - File Upload/Remote Code Execution

The plugin is vulnerable to Remote Code Execution via file upload via the template import functionality, allowing authenticated attackers, with contributor-level access and above, to upload files and execute code on the server. id: CVE-2023-48777 info: name: WordPress Elementor 3.18.1 - File...

9.9CVSS7.4AI score0.041EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.24 views

WordPress Canto Plugin <= 3.0.4 - File Inclusion

Canto plugin for WordPress up to version 3.0.4 contains a remote file inclusion caused by the 'wpabspath' parameter, letting unauthenticated attackers include and execute arbitrary remote code if allowurlinclude is enabled, exploit requires allowurlinclude to be enabled. id: CVE-2023-3452 info:...

9.8CVSS7.5AI score0.06958EPSS
SaveExploits7References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.65 views

Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function. id: CVE-2023-34192 info: name: Zimbra Collaboration Suite ZCS v.8.8.15 - Cross-Site Scripting author: ritikchaddha...

9CVSS7.7AI score0.77266EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.42 views

Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload

The plugin does not validate signatures when creating them on the server from user input, allowing unauthenticated users to create arbitrary files and lead to RCE. id: CVE-2023-4666 info: name: Form-Maker 1.15.20 - Unauthenticated Arbitrary File Upload author: pussycat0x severity: critical...

9.8CVSS7.3AI score0.03283EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.597 views

JeecgBoot JimuReport - Template injection

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

9.8CVSS6.2AI score0.11503EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.104 views

mojoPortal v.2.7.0.0 - Cross-Site Scripting

Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component. id: CVE-2023-44012 info: name: mojoPortal v.2.7.0.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross...

6.1CVSS6.7AI score0.01258EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.41 views

TP-Link Archer A20 v3 Router - Cross-site Scripting

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

4.8CVSS7.4AI score0.00885EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.99 views

VvvebJs < 1.7.5 - Arbitrary File Upload

Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and obtain sensitive information via the sanitizeFileName parameter in save.php. id: CVE-2024-29272 info: name: VvvebJs 1.7.5 - Arbitrary File Upload author: s4e-...

6.5CVSS6.2AI score0.09366EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.30 views

ProjectSend <= r1605 - Improper Authorization

An improper authorization check was identified within ProjectSend version r1605 that allows an attacker to perform sensitive actions such as enabling user registration and auto validation, or adding new entries in the whitelist of allowed extensions for uploaded files. Ultimately, this allows to...

9.8CVSS7.7AI score0.91458EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.21 views

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

9.9CVSS8.3AI score0.16017EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/28 4:35 a.m.247 views

Calibre <= 7.14.0 Remote Code Execution

Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

9.8CVSS7.7AI score0.84116EPSS
SaveExploits8References1
Rows per page
Query Builder