Lucene search
+L

2551214 matches found

Nuclei
Nuclei
added 13 hours ago51 views

Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion

Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a ticket.downloadattachment task. id: CVE-2015-4074 info: name: Joomla! Helpdesk Pro plugin 1.4.0 - Local File...

7.5CVSS7.9AI score0.5651EPSS
SaveExploits5References5
Nuclei
Nuclei
added 13 hours ago58 views

WordPress DB Backup <=4.5 - Local File Inclusion

WordPress Plugin DB Backup 4.5 and possibly prior versions are prone to a local file inclusion vulnerability because they fail to sufficiently sanitize user-supplied input. Exploiting this issue can allow an attacker to obtain sensitive information that could aid in further attacks. id:...

5CVSS8.5AI score0.15652EPSS
SaveExploits2References5
Nuclei
Nuclei
added 13 hours ago28 views

Netsweeper 4.0.8 - Directory Traversal

A directory traversal vulnerability in webadmin/reporter/viewserverlog.php in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to list directory contents via a .. dot dot in the log parameter in a stats action. id: CVE-2014-9609 info: name: Netsweeper...

5.3CVSS5.8AI score0.12631EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago75 views

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. id: CVE-2014-2908 info: name: Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting author:...

4.3CVSS5.3AI score0.20862EPSS
SaveExploits3References5
Nuclei
Nuclei
added 13 hours ago37 views

WordPress heat-trackr 1.0 - Cross-Site Scripting

WordPress heat-trackr 1.0 contains a cross-site scripting vulnerability via heat-trackrabtestadd.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

6.1CVSS6.2AI score0.03415EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago35 views

WordPress Photoxhibit 2.1.8 - Cross-Site Scripting

WordPress Photoxhibit 2.1.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials an...

6.1CVSS6.1AI score0.03558EPSS
SaveExploits1References5
Nuclei
Nuclei
added 13 hours ago31 views

Shortcode Ninja <= 1.4 - Cross-Site Scripting

A cross-site scripting vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. id: CVE-2014-4550 info: name: Shortcode Ninja = 1.4 - Cross-Site Scripting...

6.1CVSS6AI score0.03918EPSS
SaveExploits2References3
Nuclei
Nuclei
added 13 hours ago34 views

McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting

McAfee Network Data Loss Prevention User-Agent 9.3.x contains a cross-site scripting vulnerability which allows remote attackers to get session/cookie information via modification of the HTTP request. id: CVE-2017-4011 info: name: McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting...

6.1CVSS5.8AI score0.03271EPSS
SaveExploits0References5
Nuclei
Nuclei
added 13 hours ago43 views

Joomla! Component RWCards 3.0.11 - Local File Inclusion

A directory traversal vulnerability in captcha/captchaimage.php in the RWCards comrwcards 3.0.11 component for Joomla! when magicquotesgpc is disabled allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the img parameter. id: CVE-2008-6172 inf...

6.8CVSS5.8AI score0.12284EPSS
SaveExploits2References4
Nuclei
Nuclei
added 13 hours ago49 views

WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting

WordPress Pondol Form to Mail 1.1 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticati...

6.1CVSS6.2AI score0.03462EPSS
SaveExploits1References3
Nuclei
Nuclei
added 13 hours ago71 views

Xibo 1.2.2/1.4.1 - Directory Traversal

A directory traversal vulnerability in Spring Signage Xibo 1.2.x before 1.2.3 and 1.4.x before 1.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the p parameter to index.php. id: CVE-2013-5979 info: name: Xibo 1.2.2/1.4.1 - Directory Traversal author: daffainfo severity:...

5CVSS5.6AI score0.18125EPSS
SaveExploits3References5
Nuclei
Nuclei
added 13 hours ago56 views

SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion

SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. dot dot in the path parameter to /Catalog, aka SAP Security Note 2230978. id: CVE-2016-2389 info: name: SAP xMII...

7.8CVSS7.5AI score0.4145EPSS
SaveExploits4References5
Nuclei
Nuclei
added 13 hours ago94 views

Cherokee HTTPD <=0.5 - Cross-Site Scripting

Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. id: CVE-2006-1681 info:...

4.3CVSS5.2AI score0.06643EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago47 views

WordPress Plugin WP Content Source Control - Directory Traversal

A directory traversal vulnerability in the filegetcontents function in downloadfiles/download.php in the WP Content Source Control wp-source-control plugin 3.0.0 and earlier for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the path parameter. id: CVE-2014-5368 inf...

5CVSS8.8AI score0.18817EPSS
SaveExploits2References5
Nuclei
Nuclei
added 13 hours ago35 views

Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

9.8CVSS6.6AI score0.40992EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago20 views

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal

Windmill 1.603.3 contains a path traversal caused by unsanitized filename parameter in getlogfile endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication. id: CVE-2026-29059 info: name: Windmill/Nextcloud Flow 1.603.3 - Unauthenticated Pa...

7.5CVSS8AI score0.02608EPSS
SaveExploits0References3
Nuclei
Nuclei
added 13 hours ago33 views

WordPress FluentCRM <= 2.9.87 - Unauthenticated Blind SSRF

FluentCRM WordPress plugin = 2.9.87 contains a blind server-side request forgery caused by improper validation of the 'SubscribeURL' parameter, letting unauthenticated attackers make arbitrary web requests, exploit requires unconfigured SES bounce handling key. id: CVE-2026-7798 info: name:...

5.4CVSS5.4AI score0.00695EPSS
SaveExploits0References3
Nuclei
Nuclei
added 13 hours ago58 views

Frappe Framework < 16.15.0 - Arbitrary File Read via render_include Path Traversal

Frappe is a full-stack web application framework. Versions prior to 15.105.0 and 16.15.0 contain a possible Arbitrary File Read vulnerability via Path Traversal. The issue is resolved in versions 16.15.0, 15.105.0 and above. id: CVE-2026-39352 info: name: Frappe Framework 16.15.0 - Arbitrary File...

8.7CVSS5.3AI score0.01279EPSS
SaveExploits0References4
Nuclei
Nuclei
added 13 hours ago34 views

DbGate - Remote Code Execution via Anonymous JWT

DbGate contains a remote code execution vulnerability exploitable by unauthenticated attackers. The /auth/login endpoint issues anonymous JWT tokens without credentials, and the /runners/start endpoint accepts JavaScript payloads that execute via Node.js childprocess, allowing arbitrary command...

10CVSS9.6AI score0.04339EPSS
SaveExploits3References3
Nuclei
Nuclei
added 13 hours ago13 views

WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion

Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campresswoocommercegetajaxproducts' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication. id: CVE-2024-10763 info: name: WordPress Campress Theme =...

9.8CVSS9.3AI score0.03655EPSS
SaveExploits0References1
Rows per page
Query Builder