Lucene search
+L

2551616 matches found

Nuclei
Nuclei
added 17 hours ago121 views

Z-Blog <=1.5.2 - Open Redirect

Z-Blog 1.5.2 and earlier contains an open redirect vulnerability via the redirect parameter in zbsystem/cmd.php. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-18268 info: name: Z-Blo...

6.1CVSS6.2AI score0.02687EPSS
SaveExploits1References4
Nuclei
Nuclei
added 17 hours ago604 views

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. id: CVE-2012-4547 info: name: AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting author: dhiyaneshDk severity: medium description: AWStats is prone to multip...

4.3CVSS4.9AI score0.05796EPSS
SaveExploits1References5
Nuclei
Nuclei
added 17 hours ago75 views

SuperWebmailer 7.21.0.01526 - Remote Code Execution

SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection. id: CVE-2020-11546 info: name: SuperWebmailer...

9.8CVSS9.8AI score0.32841EPSS
SaveExploits1References5
Nuclei
Nuclei
added 17 hours ago22 views

WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting

WordPress Skaut Bazar plugin before 1.3.3 contains a reflected cross-site scripting vulnerability due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file, which allows attackers to inject arbitrary web scripts. id: CVE-2021-34643 info: name: WordPress Skaut Bazar 1.3.3 - Cross-Site...

6.1CVSS5.9AI score0.0235EPSS
SaveExploits2References5
Nuclei
Nuclei
added 17 hours ago211 views

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

9.8CVSS9.4AI score0.74519EPSS
SaveExploits0References5
Nuclei
Nuclei
added 17 hours ago91 views

Grafana v8.x - Arbitrary File Read

Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is /public/plugins/NAME/, where NAME is the plugin ID for any installed plugin. id: CVE-2021-43798 info: name: Grafana v8.x - Arbitrary File Read autho...

7.5CVSS8.3AI score0.88849EPSS
SaveExploits45References5
Nuclei
Nuclei
added 17 hours ago77 views

LabKey Server Community Edition <18.3.0 - Cross-Site Scripting

LabKey Server Community Edition before 18.3.0-61806.763 contains a reflected cross-site scripting vulnerability via the onerror parameter in the /r2/query endpoints, which allows an unauthenticated remote attacker to inject arbitrary JavaScript. id: CVE-2019-3911 info: name: LabKey Server Communi...

6.1CVSS6AI score0.03813EPSS
SaveExploits1References3
Nuclei
Nuclei
added 17 hours ago349 views

Gogs (Go Git Service) 0.11.66 - Remote Code Execution

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. id: CVE-2018-18925 info: name: Go...

9.8CVSS9AI score0.31133EPSS
SaveExploits2References5
Nuclei
Nuclei
added 17 hours ago114 views

The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting

The Wordpress plugin Code Snippets before 2.14.3 does not escape the snippets-safe-mode parameter before reflecting it in attributes, leading to a reflected cross-site scripting issue. id: CVE-2021-25008 info: name: The Code Snippets WordPress Plugin 2.14.3 - Cross-Site Scripting author: cckuailo...

6.1CVSS5.8AI score0.02258EPSS
SaveExploits2References4
Nuclei
Nuclei
added 17 hours ago99 views

WordPress Button Generator <2.3.3 - Remote File Inclusion

WordPress Button Generator before 2.3.3 within the wow-company admin menu page allows arbitrary file inclusion with PHP extensions as well as with data:// or http:// protocols, thus leading to cross-site request forgery and remote code execution. id: CVE-2021-25052 info: name: WordPress Button...

8.8CVSS8.5AI score0.02985EPSS
SaveExploits2References5
Nuclei
Nuclei
added 17 hours ago67 views

Allied Telesis AT-GS950/8 - Local File Inclusion

Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 is susceptible to local file inclusion via its web interface. id: CVE-2019-18922 info: name: Allied Telesis AT-GS950/8 - Local File Inclusion author: 0xAkoko severity: high description: | Allied Telesis AT-GS950/8 until Firmware AT-S107...

7.8CVSS7.8AI score0.24742EPSS
SaveExploits2References5
Nuclei
Nuclei
added 17 hours ago17 views

Schneider Electric U.motion Builder - SQL Injection

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...

8.8CVSS8.4AI score0.02917EPSS
SaveExploits3References2
Nuclei
Nuclei
added 17 hours ago53 views

WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting

wp-live-chat-support plugin before 8.0.27 for WordPress contains a reflected cross-site scripting caused by insufficient sanitization in the GDPR page, letting attackers execute arbitrary scripts in the context of the victim's browser, exploit requires victim to visit a malicious page. id:...

6.1CVSS6.1AI score0.01211EPSS
SaveExploits0References3
Nuclei
Nuclei
added 17 hours ago32 views

Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion

Media Library Assistant plugin for WordPress before 2.82 contains a local file inclusion caused by unsanitized mlagallery link parameter, letting attackers include arbitrary local files, exploit requires access to the vulnerable link. id: CVE-2020-11732 info: name: Media Library Assistant 2.82 -...

7.5CVSS7.5AI score0.04917EPSS
SaveExploits4References1
Nuclei
Nuclei
added 17 hours ago165 views

FlightPath - Local File Inclusion

FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion. id: CVE-2019-13396 info: name: FlightPath - Local File Inclusion author: 0xAkoko,daffainfo severity: medium description: FlightPath versions prior to 4.8.2 and 5.0-rc2 are vulnerable to local file inclusion...

5.3CVSS5.4AI score0.62572EPSS
SaveExploits5References5
Nuclei
Nuclei
added 17 hours ago75 views

AxxonSoft Axxon Next - Local File Inclusion

AxxonSoft Axxon Next suffers from a local file inclusion vulnerability. id: CVE-2018-7467 info: name: AxxonSoft Axxon Next - Local File Inclusion author: 0xAkoko severity: high description: AxxonSoft Axxon Next suffers from a local file inclusion vulnerability. impact: | An attacker can read...

7.5CVSS7.3AI score0.10169EPSS
SaveExploits2References5
Nuclei
Nuclei
added 17 hours ago63 views

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

8.3CVSS6.4AI score0.70511EPSS
SaveExploits3References5
Nuclei
Nuclei
added 17 hours ago110 views

Python Flask-Security - Open Redirect

Python Flask-Security contains an open redirect vulnerability. Existing code validates that the URL specified in the next parameter is either relative or has the same network location as the requesting URL. Certain browsers accept and fill in the blanks of possibly incomplete or malformed URLs. A...

6.1CVSS6.6AI score0.03289EPSS
SaveExploits0References5
Nuclei
Nuclei
added 17 hours ago69 views

BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting

BeyondTrust Secure Remote Access Base through 6.0.1 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML. id: CVE-2021-31589 info: name: BeyondTrust Secure Remote Access Base =6.0.1 - Cross-Site Scripting author: Ahmed Abou-Ela,r3Y3r53...

6.1CVSS6AI score0.28207EPSS
SaveExploits3References5
Nuclei
Nuclei
added 17 hours ago72 views

Knowage Suite 7.3 - Cross-Site Scripting

Knowage Suite 7.3 contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter. id: CVE-2021-30213 info: name: Knowage Suite 7.3 - Cross-Site Scripting author: alph4byt3 severity:...

6.1CVSS5.9AI score0.02721EPSS
SaveExploits1References5
Rows per page
Query Builder