Lucene search
+L

318913 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.81 views

WordPress White Label CMS <2.2.9 - Cross-Site Scripting

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. id: CVE-2022-0422 info: name: WordPress White Label CMS 2.2.9 -...

6.1CVSS6.2AI score0.0812EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.48 views

CP Image Store with Slideshow <= 1.0.67 - SQL Injection

The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the orderingby query parameter before using it in a SQL statement in pages where the codepeople-image-store is embed, allowing unauthenticated users to perform an SQL injection attack. id: CVE-2022-1692...

9.8CVSS8.1AI score0.10648EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.93 views

MCMS 5.2.5 - SQL Injection

MCMS 5.2.5 contains a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-23898 info:...

9.8CVSS8.3AI score0.07734EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.71 views

WebTareas 2.4p5 - SQL Injection

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php. id: CVE-2022-44291 info: name: WebTareas 2.4p5 - SQL Injection author: theamanrawat severity: critical description: | webTareas 2.4p5 was discovered to contain a SQL injection...

9.8CVSS8.2AI score0.03654EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.72 views

Stock Ticker <= 3.23.2 - Cross-Site-Scripting

The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajaxstocktickersymbolsearchtest function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.1CVSS7.2AI score0.48879EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.69 views

SpeakOut Email Petitions < 2.14.15.1 - SQL Injection

The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dkspeakoutsendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users. id: CVE-2022-0846 info: name: SpeakOut Email...

9.8CVSS8.1AI score0.08785EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.57 views

Complete Online Job Search System 1.0 - SQL Injection

Complete Online Job Search System 1.0 contains a SQL injection vulnerability via /eris/index.php?q=category&search=. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

7.2CVSS7.2AI score0.04563EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.55 views

WordPress Copyright Proof <=4.16 - Cross-Site-Scripting

WordPress Copyright Proof plugin 4.16 and prior contains a cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back via an AJAX action available to both unauthenticated and authenticated users when a specific setting is enabled. id: CVE-2022-1906...

6.1CVSS6.2AI score0.01117EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.99 views

Wavlink WN-533A8 - Cross-Site Scripting

Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the loginpage parameter. id: CVE-2022-34048 info: name: Wavlink WN-533A8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Wavlink WN-533A8 M33A8.V5030.190716 contains a...

6.1CVSS6.2AI score0.06599EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.78 views

WordPress Daily Prayer Time <2022.03.01 - SQL Injection

WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerability.. It does not sanitise and escape the month parameter before using it in a SQL statement via the getmonthlytimetable AJAX action, available to unauthenticated users, leading to SQL injection. id:...

9.8CVSS8.1AI score0.09044EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.65 views

Academy Learning Management System <5.9.1 - Cross-Site Scripting

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.2AI score0.02512EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.114 views

AudioCodes Device Manager Express - SQL Injection

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the processlogin.php login form. id: CVE-2022-24627 info: name: AudioCodes Device Manager Express - SQL Injection author: geeknik severity: critical...

9.8CVSS8.1AI score0.26389EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.67 views

WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting

WordPress Panda Pods Repeater Field before 1.5.4 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. This can be leveraged against a user who has at least Contributor permission. An attacker can also steal...

5.4CVSS5.8AI score0.00841EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.53 views

WordPress Master Elements <=8.0 - SQL Injection

WordPress Master Elements plugin through 8.0 contains a SQL injection vulnerability. The plugin does not validate and escape the metaids parameter of its removepostmetacondition AJAX action, available to both unauthenticated and authenticated users, before using it in a SQL statement. An attacker...

9.8CVSS8.3AI score0.06918EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.35 views

Roxy-WI - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the delcert parameter without proper input validation in the /app/options.py file, allowing attackers to inject arbitrary OS commands. id: CVE-2022-31161 info: name: Roxy-WI - Remote Code...

10CVSS8.9AI score0.90387EPSS
SaveExploits15References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.95 views

WordPress Fontsy <=1.8.6 - SQL Injection

WordPress Fontsy plugin through 1.8.6 is susceptible to SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative...

9.8CVSS8.3AI score0.04756EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.69 views

Cuppa CMS v1.0 - SQL injection

Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/tablemanager/ via the searchword parameter. id: CVE-2022-24264 info: name: Cuppa CMS v1.0 - SQL injection author: theamanrawat severity: high description: | Cuppa CMS v1.0 was discovered to contain...

7.8CVSS7.2AI score0.06711EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.176 views

UpdraftPlus < 1.22.9 - Cross-Site Scripting

The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. id: CVE-2022-0864 info: name: UpdraftPlus 1.22.9 - Cross-Site Scripting author: DhiyaneshDk severity: medium description...

6.1CVSS6.3AI score0.07415EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.80 views

Liferay Portal - Cross-site Scripting

A Cross-site scripting XSS vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the tag parameter. id:...

6.1CVSS6.4AI score0.00966EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.28 views

KeySight RF - smsRestoreDatabaseZip UNC path to Remote Code Execution

The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file i.e., \\sms,...

9.8CVSS8.2AI score0.54072EPSS
SaveExploits0References2
Rows per page
Query Builder