Lucene search
+L

50791 matches found

Nuclei
Nuclei
added 2026/09/02 7:49 a.m.122 views

Apache Superset <=1.3.2 - Default Login

Apache Superset through 1.3.2 contains a default login vulnerability via registered database connections for authenticated users. An attacker can obtain access to user accounts and thereby obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2021-44451 info:...

6.5CVSS6.7AI score0.07863EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.65 views

WAVLINK WN530HG4 - Improper Access Control

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...

9.8CVSS7.3AI score0.03193EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.86 views

Unyson < 2.7.27 - Cross Site Scripting

The plugin does not sanitise and escape the QUERYSTRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters id: CVE-2022-2219 info: name: Unyson 2.7.27 - Cross Site Scripting author: r3Y3r53 severity: high description:...

7.2CVSS7.1AI score0.01619EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.212 views

Fastjson Insecure Deserialization - Remote Code Execution

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi-// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

10CVSS7.6AI score0.3897EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.83 views

TP-Link - OS Command Injection

The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840NEUV5171211 is vulnerable to remote code execution via a specially crafted payload in an IP address input field. id: CVE-2021-41653 info: name: TP-Link - OS Command Injection author: gy741 severity: critical...

10CVSS7.8AI score0.76045EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.52 views

Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion

A directory traversal vulnerability in the Realtyna Translator comrealtyna component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-2682 info: name: Joomla!...

7.5CVSS6AI score0.14311EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.156 views

Vanna - SQL injection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

9.8CVSS7.5AI score0.03424EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.55 views

Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion

Joomla! JoomlaPraise Projectfork comprojectfork 2.0.10 allows remote attackers to read arbitrary files via local file inclusion in the section parameter to index.php. id: CVE-2009-2100 info: name: Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion author: daffainfo severity: medium...

5CVSS6AI score0.08229EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.26 views

WordPress Image Hover Ultimate - Unauthenticated Settings Update

Unauthenticated Arbitrary Options Update vulnerability leading to full website compromise discovered in Image Hover Effects Ultimate versions = 9.6.1 WordPress plugin. id: CVE-2021-36888 info: name: WordPress Image Hover Ultimate - Unauthenticated Settings Update author: riteshs4hu severity:...

9.8CVSS7.2AI score0.0674EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.79 views

Microweber < 1.2.17 - Cross-Site Scripting

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. id: CVE-2022-2130 info: name: Microweber 1.2.17 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS vulnerability in the...

6.5CVSS6.6AI score0.03076EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.69 views

Bangresto - SQL Injection

Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter. id: CVE-2022-46443 info: name: Bangresto - SQL Injection author: Harsh severity: high description: | Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter. impact: | Successful exploitation of...

8.8CVSS7.3AI score0.37729EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.97 views

MKdocs 1.2.2 - Directory Traversal

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

7.5CVSS7.2AI score0.15103EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.56 views

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

7.5CVSS7.4AI score0.0364EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.63 views

11in1 CMS 1.2.1 - Local File Inclusion (LFI)

Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. dot dot in the class parameter to 1 index.php or 2 admin/index.php. id: CVE-2012-0996 info: name: 11in1 CMS 1.2.1 - Local File Inclusion LFI author: daffainfo...

5CVSS6AI score0.09794EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.79 views

SuperWebMailer - Cross-Site Scripting

An issue was discovered in SuperWebMailer 9.00.0.01710 that allows keepalive.php XSS via a GET parameter. id: CVE-2023-38194 info: name: SuperWebMailer - Cross-Site Scripting author: ritikchaddha severity: medium description: | An issue was discovered in SuperWebMailer 9.00.0.01710 that allows...

6.1CVSS6.4AI score0.01131EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.32 views

Landray EKP - Path Traversal

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible to...

6.9CVSS6AI score0.05747EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/02 7:49 a.m.30 views

Arelle < 2.39.10 - Remote Code Execution

Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the webserver's /rest/configure endpoint. The plugins query parameter is forwarded to the plugin manager without authentication, allowing an attacker to supply a URL to a remote Python file that Arelle...

9.8CVSS6.4AI score0.02747EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/02 7:35 a.m.7 views

Ashwesker-CVE-2026-21962

😈 CVE-2026-21962 — Critical Security Vulnerability 😈 🚨 Severity CVSS Score: 10.0 / 10 Critical Published: January 20, 2026 Risk Level: 🔥 Maximum — immediate action recommended 🧠 What is it? A critical vulnerability affecting: Oracle HTTP Server Oracle WebLogic Server Proxy Plug-in for Apache & II...

10CVSS7.3AI score0.4202EPSS
SaveExploits6
Kitploit
Kitploit
added 2026/09/02 6:11 a.m.4 views

Event-ID-263-Arbitrary-File-Read-on-Checkpoint-Security-Gateway-CVE-2024-24919-

SOCアラート分析: Checkpoint Security Gateway CVE-2024-24919 における任意ファイル読み取り はじめに CVE-2024-24919 は、Check Point Security Gateways...

8.6CVSS7.3AI score0.99978EPSS
SaveExploits53References1
Kitploit
Kitploit
added 2026/09/02 5:55 a.m.5 views

CVE-2019-9745

Autor: Arn Vollebregt Introducción La creatividad está en el núcleo de las pruebas de penetración, lo que mantiene nuestro trabajo interesante. Sin embargo, un escollo es la tendencia a 'sobreingeniería' de escenarios de ataque y centrarse únicamente en bugs condiciones de error. Los fallos...

7.8CVSS7.1AI score0.0047EPSS
SaveExploits2
Rows per page
Query Builder