Lucene search
+L

318674 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.56 views

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. id:...

7.5CVSS6.5AI score0.251EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.94 views

Gryphon Tower - Cross-Site Scripting

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

6.1CVSS6.3AI score0.02557EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.81 views

WordPress Pie Register <3.7.0.1 - Cross-Site Scripting

WordPress Pie Register plugin before 3.7.0.1 is susceptible to cross-site scripting. The plugin does not sanitize the invitaioncode GET parameter when outputting it in the Activation Code page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the...

6.1CVSS6.1AI score0.01602EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.149 views

WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting

WordPress Select All Categories and Taxonomies plugin before 1.3.2 contains a cross-site scripting vulnerability. The settings page of the plugin does not properly sanitize the tab parameter before outputting it back. An attacker can inject arbitrary script in the browser of an unsuspecting user ...

6.1CVSS6.2AI score0.10358EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.114 views

SysAid 20.4.74 - Cross-Site Scripting

SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via the KeepAlive.jsp stamp parameter. id: CVE-2021-31862 info: name: SysAid 20.4.74 - Cross-Site Scripting author: jas37 severity: medium description: SysAid 20.4.74 contains a reflected cross-site scripting vulnerability via...

6.1CVSS6.2AI score0.03985EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.65 views

Cloudron 6.2 Cross-Site Scripting

In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to cross-site scripting. id: CVE-2021-40868 info: name: Cloudron 6.2 Cross-Site Scripting author: daffainfo severity: medium description: In Cloudron 6.2, the returnTo parameter on the login page is vulnerable to cross-site...

6.1CVSS6AI score0.09071EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.108 views

FUDForum 3.1.0 - Cross-Site Scripting

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. id: CVE-2021-27519 info: name: FUDForum 3.1.0 - Cross-Site Scripting author: kh4sh3i severity: medium description: | FUDForum 3.1.0 contains a...

6.1CVSS6.2AI score0.07604EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.124 views

Photo Gallery by 10Web < 1.6.0 - SQL Injection

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwgtagidbwgthumbnails0 parameter before using it in a SQL statement via the bwgfrontenddata AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL injection id:...

9.8CVSS8.1AI score0.74615EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.55 views

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

6.1CVSS6.2AI score0.01117EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.91 views

WordPress Order Listener for WooCommerce <3.2.2 - SQL Injection

WordPress Order Listener for WooCommerce plugin before 3.2.2 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute...

9.8CVSS8.2AI score0.09879EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.35 views

Roxy-WI - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands. id: CVE-2022-31161 info: name: Roxy-WI - Remote Code...

10CVSS8.9AI score0.90387EPSS
SaveExploits15References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.99 views

Wavlink WN-533A8 - Cross-Site Scripting

Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the loginpage parameter. id: CVE-2022-34048 info: name: Wavlink WN-533A8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Wavlink WN-533A8 M33A8.V5030.190716 contains a...

6.1CVSS6.2AI score0.06599EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.77 views

WordPress Related Posts <2.1.3 - Stored Cross-Site Scripting

WordPress Related Posts plugin prior to 2.1.3 contains a cross-site scripting vulnerability in the rp4wpheadingtext parameter. User input is not properly sanitized, allowing the insertion of arbitrary code that can allow an attacker to steal cookie-based authentication credentials and launch othe...

5.5CVSS6.1AI score0.012EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.78 views

WordPress Daily Prayer Time <2022.03.01 - SQL Injection

WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerability.. It does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action, available to unauthenticated users, leading to SQL injection. id:...

9.8CVSS8.1AI score0.09044EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.51 views

Joomla! Component DW Graph - Local File Inclusion

A directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs comdwgraphs component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. id: CVE-2010-1302 info: name: Joomla! Component DW Grap...

5CVSS5.9AI score0.08483EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.227 views

YouPHPTube Encoder 2.3 - Remote Command Injection

YouPHPTube Encoder 2.3 is susceptible to a command injection vulnerability which could allow an attacker to compromise the server. These exploitable unauthenticated command injections exist via the parameter base64Url in /objects/getImage.php. id: CVE-2019-5127 info: name: YouPHPTube Encoder 2.3 ...

10CVSS8.2AI score0.45302EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.31 views

Joomla! Component SVMap 1.1.1 - Local File Inclusion

A directory traversal vulnerability in the SVMap comsvmap component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1308 info: name: Joomla! Component SVMap 1.1.1 - Local File Inclusion author: daffainfo...

5CVSS5.9AI score0.13997EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.35 views

Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal

A directory traversal vulnerability in the Percha Downloads Attach comperchadownloadsattach component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-2037 info: name...

7.5CVSS6AI score0.11077EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.66 views

Joomla! Component com_rokdownloads - Local File Inclusion

A directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1056 info: name: Joomla! Component comrokdownload...

6.8CVSS6.2AI score0.11414EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.78 views

Joomla! Component SmartSite 1.0.0 - Local File Inclusion

A directory traversal vulnerability in the SmartSite comsmartsite component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1657 info: name: Joomla! Component SmartSite 1.0.0 - Local File Inclusion author:...

5CVSS5.9AI score0.19192EPSS
SaveExploits2References5
Rows per page
Query Builder