Lucene search
+L

505987 matches found

Nuclei
Nuclei
added 2026/08/23 2:28 a.m.19 views

Scramble Laravel - Remote Code Execution

Scramble for Laravel = 0.13.2 and = 0.13.2 and 0.13.22 contains a remote code execution caused by evaluation of user-controlled input in validation rules during documentation generation, letting remote attackers execute arbitrary PHP code, exploit requires publicly accessible documentation...

9.4CVSS9.8AI score0.0586EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.6 views

Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload

Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitrary file uploads due to missing file type validation in the podlovehandlecachefiles function. The image cache derives the stored file extension from the path of the attacker supplied source URL, while the image...

9.8CVSS5.6AI score0.02959EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.246 views

Calibre <= 7.14.0 Remote Code Execution

Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0. id: CVE-2024-6782 info: name: Calibre = 7.14.0 Remote Code Execution author: DhiyaneshDK severity: critical description: | Unauthenticated remote code execution via Calibre’s content server in Calibre = 7.14.0...

9.8CVSS9.5AI score0.84116EPSS
SaveExploits8References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.65 views

Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution

Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...

8.1CVSS5.8AI score0.04175EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.34 views

WordPress Slider Future <= 1.0.5 - Unauthenticated Arbitrary File Upload

Slider Future WordPress plugin = 1.0.5 contains an unrestricted file upload vulnerability caused by missing file type validation in 'sliderfuturehandleimageupload', letting unauthenticated attackers upload arbitrary files, exploit requires no authentication. id: CVE-2026-1405 info: name: WordPres...

9.8CVSS5.5AI score0.03177EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.31 views

WordPress Kali Forms <= 2.4.9 - Remote Code Execution

Kali Forms WordPress plugin = 2.4.9 contains a remote code execution caused by unsafe user input handling in 'formprocess' and 'preparepostdata' functions, letting unauthenticated attackers execute code on the server, exploit requires no authentication. id: CVE-2026-3584 info: name: WordPress Kal...

9.8CVSS6.3AI score0.07239EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.93 views

Swift Performance Lite < 2.3.7.2 - Local PHP File Inclusion

A vulnerability in Swift Performance Lite before version 2.3.7.2 allows unauthenticated attackers to perform local PHP file inclusion via the 'ajaxify' parameter. This can lead to arbitrary code execution on the server. id: CVE-2024-10516 info: name: Swift Performance Lite 2.3.7.2 - Local PHP Fil...

8.1CVSS9.6AI score0.06479EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.37 views

Google ADK-Python - Unauthenticated Builder Endpoint

Google Agent Development Kit ADK 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2 on Python OSS, Cloud Run, and GKE contains a code injection and missing authentication vulnerability, letting unauthenticated remote attackers execute arbitrary code on the server, exploit requires no authentication...

10CVSS5.9AI score0.01818EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.261 views

Symfony - Authentication Bypass

Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including 1 no hash or 2 an invalid has...

4.3CVSS5.3AI score0.08269EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.35 views

MindsDB - Remote Code Execution

MindsDB 25.9.1.1 contains a remote code execution caused by path traversal in the /api/files upload file module, letting authenticated attackers write arbitrary files and execute commands, exploit requires authentication. id: CVE-2026-27483 info: name: MindsDB - Remote Code Execution author:...

8.8CVSS6.4AI score0.11113EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.24 views

Tandoor Recipes < 1.5.24 - Jinja2 SSTI RCE

Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows command execution via recipe steps. id: CVE-2025-23211 info: name: Tandoor Recipes 1.5.24 - Jinja2 SSTI RCE author: sammiee5311 severity: critical description: | Tandoor Recipes 1.5.24 has a Jinja2 SSTI vulnerability that allows...

9.9CVSS5.5AI score0.03593EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.29 views

ZZZCMS ZZZPHP 1.6.3 – Remote PHP Code Execution (RCE)

ZZZCMS zzzphp v1.6.3 contains a remote code execution caused by lack of restrictions in inc/zzzfile.php, letting attackers execute arbitrary PHP code via a crafted URL in the plugins/ueditor/php/controller.php?action=catchimage source parameter, exploit requires attacker to send malicious URL and...

9.8CVSS9.8AI score0.03153EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.590 views

JeecgBoot JimuReport - Template injection

A vulnerability was found in jeecgboot JimuReport up to 1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Template Handler. The manipulation leads to injection. The attack can be launched remotely. The exploit has been disclosed t...

9.8CVSS6.3AI score0.11503EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.24 views

Pandora FMS <=7.0NG.722 - Remote Code Execution

Pandora FMS versions =7.0NG.722 are vulnerable to unauthenticated remote code execution by chaining an unrestricted file upload CVE-2018-11221 and a local file inclusion CVE-2018-11222. An attacker can upload a malicious PHP file as a plugin and execute it via LFI, leading to full compromise of t...

9.8CVSS8.6AI score0.03314EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.224 views

Seagate BlackArmor NAS - Command Injection

Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the authname parameter to localhost/backupmgmt/preconnectcheck.php. id: CVE-2014-3206 info: name: Seagate BlackArmor NAS - Command Injection author: gy741...

10CVSS9.3AI score0.21447EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.206 views

Fastjson Insecure Deserialization - Remote Code Execution

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

10CVSS9.3AI score0.13227EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.49 views

WordPress Admin Font Editor <=1.8 - Cross-Site Scripting

WordPress Admin Font Editor 1.8 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6.1AI score0.03868EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.68 views

Apache Struts <2.3.1.1 - Remote Code Execution

Apache Struts before 2.3.1.1 is susceptible to remote code execution. When developer mode is used in the DebuggingInterceptor component, a remote attacker can execute arbitrary OGNL commands via unspecified vectors, which can allow for execution of malware, obtaining sensitive information,...

6.8CVSS9.5AI score0.729EPSS
SaveExploits10References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.45 views

Podcast Channels < 0.28 - Cross-Site Scripting

The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability. id: CVE-2014-4544 info: name: Podcast Channels 0.28 - Cross-Site Scripting author: daffainfo severity: medium description: The Podcast Channels WordPress plugin was...

6.1CVSS5.7AI score0.03779EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.32 views

UniFi Access - Broken Access Control

UniFi Access Application 3.3.22 through 3.4.31 contains a broken authentication caused by misconfiguration exposing management API without proper authentication, letting attackers on management network access management functions, exploit requires network access. id: CVE-2025-52665 info: name:...

10CVSS9.1AI score0.40972EPSS
SaveExploits0References3
Rows per page
Query Builder