Lucene search
+L

1131709 matches found

Nuclei
Nuclei
added 2026/08/29 10:07 a.m.124 views

Cloudpanel 2 < 2.3.1 - Remote Code Execution

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...

9.8CVSS7.3AI score0.74888EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.120 views

Github Enterprise - Remote Code Execution

An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. This vulnerability could lead to the execution of user-controlled methods and remote code execution. To exploit this bug, an actor would need to be logged into an account on the...

9.8CVSS7.6AI score0.71725EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.268 views

Atlassian Confluence - Remote Code Execution

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server...

10CVSS7.4AI score0.99984EPSS
SaveExploits34References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.84 views

Microweber <1.2.12 - Integer Overflow

Microweber before 1.2.12 is susceptible to integer overflow. The application allows large characters to insert in the input field 'first & last name,' which can allow an attacker to cause a denial of service via a crafted HTTP request. id: CVE-2022-0968 info: name: Microweber 1.2.12 - Integer...

7.2CVSS6.7AI score0.03731EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.115 views

Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

An unrestricted file upload in WordPress Tatsubuilder plugin version = 3.3.11 enables an unauthenticated attacker to perform a remote code execution RCE on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk. id: CVE-2021-25094 info: name:...

8.1CVSS7.7AI score0.83354EPSS
SaveExploits9References3
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.25 views

RWS WorldServer - Authentication Bypass

An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint. id: CVE-2022-34267 info: name: RWS...

9.8CVSS7.3AI score0.42162EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.128 views

XWiki < 4.10.20 - Remote code execution

XWiki is vulnerable to a remote code execution RCE attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the "first name" or "last name" fields during user registration. This impacts all installations that have user...

10CVSS7.9AI score0.9348EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.42 views

DataEase - Remote Code Execution

DataEase is an open-source business intelligence and data visualization platform. Public advisories state that CVE-2025-49002 is related to a bypass in the previous fix for CVE-2025-32966 involving case-insensitive handling of restricted H2 JDBC keywords. This template is a non-invasive detection...

9.8CVSS5.8AI score0.47001EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.28 views

WPvivid Backup & Migration <= 0.9.123 - Arbitrary File Upload

WPvivid Backup & Migration plugin for WordPress = 0.9.123 contains an unauthenticated arbitrary file upload vulnerability caused by improper error handling in RSA decryption and lack of path sanitization, letting unauthenticated attackers upload arbitrary PHP files and achieve remote code executi...

9.8CVSS7.9AI score0.32714EPSS
SaveExploits13References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.25 views

WordPress Sexy Contact Form (<= 0.9.7) - Arbitrary File Upload

Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form formerly Sexy Contact Form before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute...

9.8CVSS7.6AI score0.91656EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.44 views

WordPress Epsilon Framework Themes <=2.4.8 - Remote Code Execution

WordPress themes including Shapely = 1.2.7, NewsMag = 2.4.1, Activello = 1.4.0, Illdy = 2.1.4, Allegiant = 1.2.2, Newspaper X = 1.3.1, Pixova Lite = 2.0.5, Brilliance = 1.2.7, MedZone Lite = 1.2.4, Regina Lite = 2.0.4, Transcend = 1.1.8, Affluent = 1.1.0, Bonkers = 1.0.4, Antreas = 1.0.2, Sparkli...

9.8CVSS7.5AI score0.65342EPSS
SaveExploits1References7
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.26 views

Schneider Electric U.motion Builder - Remote Code Execution

U.motion Builder 1.3.4 contains a remote code execution vulnerability caused by improper input sanitization, allowing attackers to execute arbitrary system commands through crafted input parameters. id: CVE-2018-7841 info: name: Schneider Electric U.motion Builder - Remote Code Execution author:...

9.8CVSS7.9AI score0.72675EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.35 views

ETQ Reliance - Authentication Bypass via Trailing Space

An authentication bypass vulnerability exists in ETQ Reliance on the CG legacy platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login pag...

9.3CVSS6.6AI score0.31157EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.29 views

Adobe ColdFusion - RDS Arbitrary File Write

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary code execution in the context of the current user. The RDS FILEIO WRITE operation allows unauthenticated...

10CVSS7.8AI score0.42388EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.79 views

Microsoft Exchange - Pre-Auth SSRF / ACL Bypass (ProxyNotFound)

Microsoft Exchange Server contains a remote code execution caused by improper input validation in the server component, letting remote attackers execute arbitrary code, exploit requires network access to the server. id: CVE-2021-28481 info: name: Microsoft Exchange - Pre-Auth SSRF / ACL Bypass...

10CVSS7.8AI score0.83214EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.119 views

CAREL Boss Mini <= 1.4.0 - Local File Inclusion

Boss Mini 1.4.0 Build 6221 contains a file inclusion caused by manipulation of the 'path' argument in boss/servlet/document, letting remote attackers include arbitrary files, exploit requires remote access. id: CVE-2023-3643 info: name: CAREL Boss Mini = 1.4.0 - Local File Inclusion author:...

9.8CVSS7.2AI score0.75363EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.58 views

n8n Webhooks - Remote Code Execution

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

10CVSS7.5AI score0.78197EPSS
SaveExploits23References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.61 views

D-Tale 3.10.0 - 3.15.1 - Authentication Bypass & Remote Code Execution

man-group/dtale 3.10.0 contains an authentication bypass and remote code execution caused by improper input validation and a hardcoded SECRETKEY in Flask configuration, letting attackers forge session cookies and execute arbitrary code, exploit requires attacker to access the application. id:...

9.8CVSS7.8AI score0.77951EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.11 views

IBM Langflow - Remote Code Execution

IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/autologin and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication. id: CVE-2026-9198 info: name: IBM Langflow - Remo...

9.8CVSS8AI score0.34734EPSS
SaveExploits7References4
Nuclei
Nuclei
added 2026/08/29 10:07 a.m.43 views

Monsta FTP <= 2.11.2 - Unauthenticated Remote Code Execution

Monsta FTP = 2.11 contains an unrestricted file upload vulnerability caused by lack of authentication on file uploads, letting unauthenticated attackers execute arbitrary code by uploading crafted files. id: CVE-2025-34299 info: name: Monsta FTP = 2.11.2 - Unauthenticated Remote Code Execution...

9.8CVSS7.5AI score0.72667EPSS
SaveExploits6References3
Rows per page
Query Builder