Lucene search
+L

505843 matches found

BDU FSTEC
BDU FSTEC
added 2026/08/23 11:44 a.m.57 views

The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

10CVSS7AI score0.00412EPSS
SaveExploits0References11Affected Software9
BDU FSTEC
BDU FSTEC
added 2026/08/23 11:44 a.m.32 views

The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.

The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...

8.5CVSS6.1AI score
SaveExploits0Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/08/23 11:44 a.m.29 views

The vulnerability of the MmMapIoSpace() function in the ThrottleBlood.sys driver allows a hacker to escalate their privileges, execute arbitrary code, or cause a service failure.

The vulnerability of the MmMapIoSpace function in the ThrottleBlood.sys driver, as part of the ThrottleStop utility, is related to open IOCTLs with insufficient access control. Exploiting this vulnerability could allow an attacker to enhance their privileges, execute arbitrary code, or cause...

7.5CVSS6AI score0.06835EPSS
SaveExploits9References3Affected Software1
BDU FSTEC
BDU FSTEC
added 2026/08/23 11:44 a.m.33 views

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

8.4CVSS6AI score0.00456EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/23 9:27 a.m.8 views

CVE-2026-10053

GitLab CE/EE is affected by a path traversal vulnerability in the package registry component that could allow an authenticated user (low privileges) to achieve remote code execution . The vulnerability affects versions 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The CVSS 3.1 s...

8.5CVSS6.4AI score
SaveExploits0References2
EUVD
EUVD
added 2026/08/23 9:27 a.m.6 views

EUVD-2026-64645

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

8.5CVSS6.4AI score
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.55 views

WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file. id: CVE-2018-19207 info: name: WP GDPR Compliance 1.4.3 - Unauthenticated Call Any Action or...

9.8CVSS8.6AI score0.88065EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.56 views

OpenAM <= 16.0.5 - Pre-Auth RCE via jato.clientSession Deserialization

Open Access Management OpenAM is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution RCE via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream...

10CVSS9.3AI score0.99999EPSS
SaveExploits10References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.34 views

Apache ActiveMQ - Remote Code Execution via HTTP Discovery Transport Bypass

Apache ActiveMQ before 5.19.6 and 6.0.0 through 6.2.4 is vulnerable to remote code execution via a bypass of the CVE-2026-34197 security fix. The original fix blocked the "vm://" transport scheme in BrokerView.addNetworkConnector and BrokerView.addConnector to prevent authenticated attackers from...

8.8CVSS7.9AI score0.9722EPSS
SaveExploits14References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.38 views

WordPress Product Slider Pro for WooCommerce < 3.5.4 - Supply Chain Backdoor RCE

Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.4. id: CVE-2026-49777 info: name: WordPress Product Slider Pro f...

10CVSS5.2AI score0.01656EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.104 views

Cockpit Web Console < 360 - Remote Code Execution

Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit web service can craft a single HTTP request to the login endpoint that injects malicious SSH...

9.8CVSS6.8AI score0.1548EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.7 views

Kopia Server 0.23.0 - Remote Code Execution

Kopia before version 0.23.0 allows unauthenticated remote code execution when started in server mode with the --without-password flag. When the /api/v1/repo/exists endpoint is exposed, it enables instantiation of the SFTP storage backend with user-supplied sshArguments. Due to improper argument...

9.8CVSS9.6AI score0.01186EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.7 views

MaxSite CMS <=109.1 - Remote Code Execution

MaxSite CMS through 109.1 allows unauthenticated remote attackers to execute arbitrary code via the MarkItUp editor preview AJAX endpoint, preview-ajax.php. The endpoint insufficiently authenticates the request, failing to ensure the user is logged in, and processes the attacker's input via unsaf...

9.8CVSS8.3AI score0.03252EPSS
SaveExploits1References6
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.15 views

FUXA <= 1.2.9 - Unauthenticated Path Traversal to Arbitrary File Write

FUXA, an open-source Node.js SCADA/HMI web interface, through version 1.2.9 exposes an unauthenticated POST /api/upload endpoint that resolves the attacker-controlled destination field from the JSON request body against the application directory with only a leading underscore prefix and no...

9.8CVSS6.5AI score0.10353EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.25 views

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

9.8CVSS6AI score0.02803EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.16 views

Flowise < 3.1.2 - node-custom-function Unauthorized RCE

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or API key to submit arbitrary JavaScript to the Custom JS Function node. When...

9.9CVSS6.7AI score0.03489EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.112 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php. This in turn can lead to...

9CVSS8.4AI score0.74979EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.97 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

9CVSS8.4AI score0.71536EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.163 views

WordPress eaSYNC Booking <1.1.16 - Arbitrary File Upload

WordPress eaSync Booking plugin bundle for hotel, restaurant and car rental before 1.1.16 is susceptible to arbitrary file upload. The plugin contains insufficient input validation of an AJAX action. An allowlist of valid file extensions is defined but is not used during the validation steps. An...

9.8CVSS9.1AI score0.23487EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.86 views

WordPress InPost Gallery <2.1.4.1 - Local File Inclusion

WordPress InPost Gallery plugin before 2.1.4.1 is susceptible to local file inclusion. The plugin insecurely uses PHP's extract function when rendering HTML views, which can allow attackers to force inclusion of malicious files and URLs. This, in turn, can enable them to execute code remotely on...

9.8CVSS8.8AI score0.09519EPSS
SaveExploits2References5
Rows per page
Query Builder