Lucene search
+L

85033 matches found

EUVD
EUVD
added 2026/08/23 9:26 a.m.10 views

EUVD-2026-64648

privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges...

9.9CVSS5.4AI score0.00479EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

ThemeGrill Demo Importer < 1.6.2 - Database Reset

ThemeGrill Demo Importer before 1.6.2 does not require authentication for wiping the database due to a resetwizardactions hook. In versions 1.3.4 and above and versions 1.6.1 and below, there is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state...

9.1CVSS8.6AI score0.04105EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.56 views

Membership Database <= 1.0 - Cross-Site Scripting

Membership Database before 1.0 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker t...

6.1CVSS7AI score0.0085EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.121 views

Dolibarr Unauthenticated Contacts Database Theft

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. id: CVE-2023-33568 info: name: Dolibarr Unauthenticated Contacts Database Theft...

7.5CVSS7.4AI score0.1494EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.110 views

Slimstat Analytics < 4.9.3.3 Subscriber - SQL Injection

The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query. id: CVE-2023-0630 info: name: Slimstat Analytics 4.9.3.3 Subscriber - SQL Injection author: DhiyaneshDK severity: high description...

8.8CVSS9AI score0.05141EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.4 views

SiYuan - SQL Execution

SiYuan = v3.7.2 contains a SQL injection caused by passing client-supplied SQL statements verbatim to the main read-write database handle in /api/search/searchEmbedBlock, letting attackers with publish RoleReader token or anonymous access read and modify content, exploit requires publish RoleRead...

10CVSS5.7AI score0.00913EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.26 views

YesWiki < 4.6.4 - Unauthenticated SQL Injection

YesWiki before version 4.6.4 contains an unauthenticated SQL injection vulnerability in the Bazar form-import path. The bnidnature parameter in FormManager::create is concatenated into an INSERT statement without sanitization, allowing unauthenticated attackers to inject arbitrary SQL and read th...

9.8CVSS6AI score0.01652EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.71 views

Palo Alto Expedition - SQL Injection

An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expeditio...

9.2CVSS9.5AI score0.99626EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.24 views

Push Notification for Post and BuddyPress <= 1.93 - SQL Injection

Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to SQL Injection via the 'onesignalexternalid' and 'onesignalgetsubscriptionoptionsid' paramters in all versions up to, and including, 1.93 due to insufficient escaping on the user supplied parameter and lack of sufficie...

9.8CVSS5.9AI score0.02758EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.46 views

REST API TO MiniProgram <= 4.7.1 - SQL Injection

The REST API TO MiniProgram plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/watch-life-net/v1/comment/getcomments REST API endpoint in all versions up to, and including, 4.7.1 due to insufficient escaping on the user supplied parameter and lack of...

7.5CVSS5.9AI score0.03792EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.67 views

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. id: CVE-2018-19386 info: nam...

6.1CVSS5.7AI score0.12616EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.64 views

Microweber Information Disclosure

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. id: CVE-2022-0281 info: name: Microweber Information Disclosure author: pikpikcu severity: high description: Microweber contains a...

7.5CVSS7.2AI score0.1201EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.75 views

74cms - ajax_street.php 'x' SQL Injection

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. id: CVE-2020-22208 info: name: 74cms - ajaxstreet.php 'x' SQL Injection author: ritikchaddha severity: critical description: | SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php. impact: | Successful...

9.8CVSS7.7AI score0.10017EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.11 views

Dgraph <=v25.3.0 - Admin Mutation Missing Authorization

Dgraph =v25.3.0 contains an authentication bypass caused by missing authorization middleware for the restoreTenant admin mutation, letting unauthenticated attackers overwrite the database, read files, and perform SSRF, exploit requires no authentication. id: CVE-2026-34976 info: name: Dgraph...

10CVSS7.7AI score0.01824EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.83 views

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=hiring&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

7.2CVSS7.5AI score0.04563EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.62 views

Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion

Joomla! Omilen Photo Gallery comomphotogallery component Beta 0.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php. id: CVE-2009-4202 info: name: Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion...

7.5CVSS5.6AI score0.08109EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.33 views

Joomla! Component WMI 1.5.0 - Local File Inclusion

A directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface aka WMI or comwmi component 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1607 info: name: Joomla!...

6.8CVSS5.7AI score0.08177EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.127 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/takeaction.php?id=. id: CVE-2022-31984 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL...

7.2CVSS7.5AI score0.04906EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.30 views

WCAPF WooCommerce Ajax Product Filter - SQL Injection

WCAPF WooCommerce Ajax Product Filter = 4.2.3 contains a time-based SQL injection caused by insufficient escaping of the 'post-author' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-3396 info: name: WCAPF WooCommerce Ajax Product Filter ...

7.5CVSS5.5AI score0.01473EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.19 views

Windmill < 1.603.3 - SQL Injection

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with...

9.9CVSS8.3AI score0.16017EPSS
SaveExploits0References4
Rows per page
Query Builder