Lucene search
+L

515625 matches found

Nuclei
Nuclei
added 2026/08/31 5:18 a.m.77 views

SuperWebmailer 7.21.0.01526 - Remote Code Execution

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection. id: CVE-2020-11546 info: name: SuperWebmailer...

9.8CVSS7.9AI score0.32841EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.79 views

Cacti v1.2.8 - Remote Code Execution

Cacti v1.2.8 is susceptible to remote code execution. This vulnerability could be exploited without authentication if "Guest Realtime Graphs" privileges are enabled. id: CVE-2020-8813 info: name: Cacti v1.2.8 - Remote Code Execution author: gy741 severity: high description: Cacti v1.2.8 is...

9.3CVSS7AI score0.73779EPSS
SaveExploits24References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.486 views

Apache Axis2 Default Login

Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...

10CVSS6.2AI score0.89871EPSS
SaveExploits18References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.63 views

ListSERV Maestro <= 9.0-8 RCE

A struts-based OGNL remote code execution vulnerability exists in ListSERV Maestro before and including version 9.0-8. id: CVE-2010-1870 info: name: ListSERV Maestro = 9.0-8 RCE author: b0yd severity: medium description: A struts-based OGNL remote code execution vulnerability exists in ListSERV...

5CVSS7.3AI score0.92015EPSS
SaveExploits22References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.41 views

Ingress-Nginx Controller - Configuration Injection via Unsanitized `auth-url` Annotation

A security issue was discovered in ingress-nginx https-//github.com/kubernetes/ingress-nginx where the auth-url Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets...

8.8CVSS6.9AI score0.32618EPSS
SaveExploits8References3
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.101 views

IncomCMS 2.0 - Arbitrary File Upload

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server. id: CVE-2020-29597 info: name: IncomCMS 2.0 - Arbitrary File Upload author: princechaddha severity: critical description: |...

9.8CVSS7.3AI score0.71006EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.129 views

WordPress WooCommerce <3.1.2 - Arbitrary Function Call

WordPress WooCommerce plugin before 3.1.2 does not have authorisation and CSRF checks in the wptadminupdatenoticeoption AJAX action available to both unauthenticated and authenticated users, as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary...

9.8CVSS7.4AI score0.25937EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.5 views

Jenkins Pipeline Groovy Plugin <=2.63 - Insecure Deserialization

Jenkins Pipeline: Groovy Plugin workflow-cps version 2.63 and earlier contains a sandbox bypass vulnerability in CpsGroovyShell.java. During parsing, compilation, and script instantiation of CPS-transformed pipeline scripts, sandbox protections are not applied, allowing authenticated users with...

9.9CVSS7.7AI score0.96868EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.368 views

ZZZCMS 1.6.1 - Remote Code Execution

ZZZCMS zzzphp V1.6.1 is vulnerable to remote code execution via the inc/zzztemplate.php file because the parserIfLabel function's filtering is not strict, resulting in PHP code execution as demonstrated by the if:assert substring. id: CVE-2019-9041 info: name: ZZZCMS 1.6.1 - Remote Code Execution...

7.2CVSS7.5AI score0.31421EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.61 views

Drupal - Remote Code Execution

Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10 V contain certain field types that do not properly sanitize data from non-form sources, which can lead to arbitrary PHP code execution in some cases. id: CVE-2019-6340 info: name: Drupal - Remote Code Execution author: madrobot severity:...

8.1CVSS7.7AI score0.92017EPSS
SaveExploits23References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.352 views

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

9.8CVSS7.6AI score0.31133EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.17 views

Apache Unomi - Remote Code Execution

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process, enabling attackers to execute arbitrary code. id: CVE-2020-11975 info: name: Apache Unomi -...

10CVSS7.5AI score0.29885EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.99 views

SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution

SEOWON INTECH SLC-130 and SLR-120S devices allow remote code execution via the ipAddr parameter to the systemlog.cgi page. id: CVE-2020-17456 info: name: SEOWON INTECH SLC-130 & SLR-120S - Unauthenticated Remote Code Execution author: gy741,edoardottt severity: critical description: SEOWON INTECH...

9.8CVSS7.8AI score0.73635EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.89 views

Inspur ClusterEngine 4.0 - Remote Code Execution

Inspur ClusterEngine V4.0 is suscptible to a remote code execution vulnerability. A remote attacker can send a malicious login packet to the control server. id: CVE-2020-21224 info: name: Inspur ClusterEngine 4.0 - Remote Code Execution author: pikpikcu severity: critical description: Inspur...

10CVSS7.7AI score0.38745EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.45 views

WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution

WordPress themes including Shapely = 1.2.7, NewsMag = 2.4.1, Activello = 1.4.0, Illdy = 2.1.4, Allegiant = 1.2.2, Newspaper X = 1.3.1, Pixova Lite = 2.0.5, Brilliance = 1.2.7, MedZone Lite = 1.2.4, Regina Lite = 2.0.4, Transcend = 1.1.8, Affluent = 1.1.0, Bonkers = 1.0.4, Antreas = 1.0.2, Sparkli...

9.8CVSS7.5AI score0.65342EPSS
SaveExploits1References7
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.113 views

DedeCMS 5.7SP2 - Cross-Site Request Forgery/Remote Code Execution

DedeCMS 5.7SP2 is susceptible to cross-site request forgery with a corresponding impact of arbitrary code execution because the partcode parameter in a tagtestaction.php request can specify a runphp field in conjunction with PHP code. id: CVE-2018-7700 info: name: DedeCMS 5.7SP2 - Cross-Site...

8.8CVSS7.4AI score0.74519EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.117 views

D-Link DNS-320 - Remote Code Execution

The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. id: CVE-2019-16057 info: name: D-Link DNS-320 - Remote Code Execution author: DhiyaneshDk severity: critical description: | The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerabl...

10CVSS7.3AI score0.87065EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.25 views

Apache Dubbo 2.5.x-2.7.4 - Insecure Deserialization

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4,...

9.8CVSS7.3AI score0.36513EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.87 views

Atlassian Confluence Download Attachments - Remote Code Execution

Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this pat...

9CVSS7.8AI score0.96837EPSS
SaveExploits10References5
Nuclei
Nuclei
added 2026/08/31 5:18 a.m.48 views

eMerge E3 1.00-06 - Local File Inclusion

Linear eMerge E3-Series devices are vulnerable to local file inclusion. id: CVE-2019-7254 info: name: eMerge E3 1.00-06 - Local File Inclusion author: 0xAkoko severity: high description: Linear eMerge E3-Series devices are vulnerable to local file inclusion. impact: | Successful exploitation of...

7.5CVSS7.1AI score0.82292EPSS
SaveExploits8References5
Rows per page
Query Builder