Lucene search
+L

223960 matches found

Nuclei
Nuclei
added yesterday162 views

Kerio Control v9.2.5 - CRLF Injection

Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5 id: CVE-2024-52875 info: name: Kerio Control v9.2.5 - CRLF Injection author: ritikchaddha,iamnoooob,rootxharsh,pdresearch...

8.8CVSS8.8AI score0.29558EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday163 views

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

8.1CVSS7.6AI score0.02862EPSS
SaveExploits0References5
Nuclei
Nuclei
added yesterday67 views

WordPress FluentForms <= 5.1.16 - Broken Access Control

The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /wp-json/fluentform/v1/global-settings REST API endpoint in all versions up to, and including,...

7.5CVSS5.3AI score0.0123EPSS
SaveExploits0References4
Nuclei
Nuclei
added yesterday27 views

Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control

The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the installoractivateaddonplugins function and a weak nonce hash in all...

9.8CVSS5.3AI score0.02904EPSS
SaveExploits0References3
Nuclei
Nuclei
added yesterday93 views

CentOS Web Panel - SQL Injection

The unprivileged user portal part of CentOS Web Panel is affected by a SQL Injection via the 'idsession' HTTP POST parameter. id: CVE-2021-31316 info: name: CentOS Web Panel - SQL Injection author: ritikchaddha severity: critical description: | The unprivileged user portal part of CentOS Web Pane...

10CVSS9.1AI score0.13029EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday114 views

Netgear-WN604 downloadFile.php - Information Disclosure

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

6.9CVSS5.7AI score0.45681EPSS
SaveExploits0References5
Nuclei
Nuclei
added yesterday53 views

WAVLINK WN535 G3 - Improper Access Control

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

7.5CVSS7.9AI score0.0364EPSS
SaveExploits1References5
Nuclei
Nuclei
added yesterday47 views

Wavlink - Improper Access Control

Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations. id: CVE-2022-48165 info: name: Wavlink -...

7.5CVSS7.3AI score0.03284EPSS
SaveExploits1References5
Nuclei
Nuclei
added yesterday85 views

Altenergy Power Control Software C1.2.5 - Remote Command Injection

Altenergy Power Control Software C1.2.5 is susceptible to remote command injection via shell metacharacters in the index.php/management/settimezone parameter, because of settimezone in models/managementmodel.php. An attacker can potentially obtain sensitive information, modify data, and/or execut...

9.8CVSS8.7AI score0.84633EPSS
SaveExploits5References5
CVE
CVE
added yesterday21 views

CVE-2026-19359

The CVE affects nxp-auto-goldvip gvip up to 1.4.0, specifically the SitewiseCustomFunction in the Lambda Function Handler. The issue enables improper access controls and can be exploited remotely. A fix is available in version 1.15.0; upgrading the affected component is advised. The accompanying ...

5.8CVSS4.8AI score
SaveExploits0References5
CVE
CVE
added yesterday21 views

CVE-2026-19358

The CVE-2026-19358 entry concerns a weakness in 3CORESec Trapdoor, affecting the DefaultFunction up to version 1.2.2. The manipulation leads to improper access controls, with the attack described as remotely initiable over the network. Connected documents corroborate the affected component and th...

6.5CVSS6.3AI score
SaveExploits0References4
GithubExploit
GithubExploit
added yesterday18 views

HermesPentBox

HermesPentBox — AI Pentest Workbench Language: English...

5.6AI score
SaveExploits0
CVE
CVE
added yesterday21 views

CVE-2026-19335

CVE-2026-19335 concerns the Jane-xiaoer skill-vision-control project, affecting the function getSkillVersionsDir in src/svc/utils/config.ts. The vulnerability arises from how the argument skillName is handled, enabling a path traversal condition. The issue is restricted to a local attack vector a...

5.3CVSS5.5AI score0.00173EPSS
SaveExploits0References6
Cvelist
Cvelist
added yesterday18 views

CVE-2026-19335 Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

5.3CVSS0.00173EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added yesterday5 views

CVE-2026-19335

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

5.3CVSS5.5AI score0.00173EPSS
SaveExploits0References7Affected Software1
EUVD
EUVD
added yesterday7 views

EUVD-2026-54885

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

5.3CVSS5.5AI score0.00173EPSS
SaveExploits0References6
Nuclei
Nuclei
added 2 days ago33 views

Centos Web Panel 0.9.8.480 - Local File Inclusion

Centos Web Panel version 0.9.8.480 suffers from local file inclusion vulnerabilities. Other vulnerabilities including cross-site scripting and remote code execution are also known to impact this version. id: CVE-2018-18323 info: name: Centos Web Panel 0.9.8.480 - Local File Inclusion author:...

7.5CVSS8.2AI score0.70736EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2 days ago118 views

Dify v1.9.1 - Broken Access Control

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. id: CVE-2025-63387 info: name: Dify v1.9.1 - Broken Access Control author:...

7.5CVSS5.2AI score0.28589EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2 days ago231 views

CrushFTP < 10.5.1 - Unauthenticated Remote Code Execution

CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. id: CVE-2023-43177 info: name: CrushFTP 10.5.1 - Unauthenticated Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: critical description: | CrushFTP prior...

9.8CVSS8.8AI score0.81801EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2 days ago25 views

Langflow - Broken Access Control

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

9.3CVSS8.3AI score0.34071EPSS
SaveExploits1References2
Rows per page
Query Builder