Lucene search
+L

2540105 matches found

Nuclei
Nuclei
added 13 hours ago65 views

Stock Ticker <= 3.23.2 - Cross-Site-Scripting

The Stock Ticker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in the ajaxstocktickersymbolsearchtest function in versions up to, and including, 3.23.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.1CVSS7.2AI score0.50642EPSS
SaveExploits0References5
Nuclei
Nuclei
added 13 hours ago81 views

Rukovoditel <= 3.2.1 - Cross-Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Entities Group feature at/index.php?module=entities/entitiesgroups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field...

5.4CVSS5.7AI score0.00903EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago79 views

WebTareas 2.4p5 - Cross-Site Scripting

webtareas 2.4p5 was discovered to contain a cross-site scripting XSS vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field. id: CVE-2022-44957 info: name: WebTareas...

5.4CVSS5.7AI score0.01037EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago75 views

WBCE CMS v1.5.4 - Cross Site Scripting (Stored)

A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field. id: CVE-2022-45037 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...

5.4CVSS5.7AI score0.01024EPSS
SaveExploits1References3
Nuclei
Nuclei
added 13 hours ago58 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Add New Field function at /index.php?module=entities/fields&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name...

5.4CVSS5.7AI score0.00937EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago83 views

Rukovoditel <= 3.2.1 - Cross Site Scripting

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting XSS vulnerability in the Highlight Row feature at /index.php?module=entities/listingtypes&entitiesid=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

5.4CVSS5.7AI score0.00961EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago71 views

WordPress Paytm Payment Gateway <=2.7.3 - SQL Injection

WordPress Paytm Payment Gateway plugin through 2.7.3 contains a SQL injection vulnerability. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-45805 info: name: WordPress Payt...

9.8CVSS8.9AI score0.02327EPSS
SaveExploits0References5
Nuclei
Nuclei
added 13 hours ago52 views

ILIAS eLearning <7.16 - Open Redirect

ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-45917 info: name: ILIAS eLearning 7.16 - Open Redirect author:...

6.1CVSS6.2AI score0.0199EPSS
SaveExploits3References5
Nuclei
Nuclei
added 13 hours ago84 views

WordPress Fontsy <=1.8.6 - SQL Injection

WordPress Fontsy plugin through 1.8.6 is susceptible to SQL injection. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative...

9.8CVSS8.8AI score0.04756EPSS
SaveExploits2References5
Nuclei
Nuclei
added 13 hours ago65 views

WebTareas 2.4p5 - SQL Injection

webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php. id: CVE-2022-44291 info: name: WebTareas 2.4p5 - SQL Injection author: theamanrawat severity: critical description: | webTareas 2.4p5 was discovered to contain a SQL injection...

9.8CVSS8.8AI score0.03587EPSS
SaveExploits1References4
Nuclei
Nuclei
added 13 hours ago30 views

XWiki >= 13.10.8 - Cross-Site Scripting

Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript. id: CVE-2023-29506 info: name: XWiki = 13.10.8 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Reflected XSS vulnerability in XWiki authenticate endpoints allows...

6.1CVSS6.5AI score0.01721EPSS
SaveExploits1References3
Nuclei
Nuclei
added 13 hours ago136 views

OPNsense - Cross-Site Scripting to RCE

There is a XSS in /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 via openAction in app/controllers/OPNsense/Cron/ItemController.php. id: CVE-2023-39007 info: name: OPNsense - Cross-Site Scripting to RCE author: ritikchaddha...

9.6CVSS8.4AI score0.02608EPSS
SaveExploits1References2
Nuclei
Nuclei
added 13 hours ago56 views

phpIPAM 1.5.1 - Cross-site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1. id: CVE-2023-0676 info: name: phpIPAM 1.5.1 - Cross-site Scripting author: ritikchaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository phpipam/phpipam prior to 1.5....

6.1CVSS5.1AI score0.01532EPSS
SaveExploits1References2
Nuclei
Nuclei
added 13 hours ago197 views

Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

The Import XML and RSS Feeds WordPress plugin before 2.1.5 allows unauthenticated attackers to execute arbitrary commands via a web shell. id: CVE-2023-4521 info: name: Import XML and RSS Feeds 2.1.5 - Unauthenticated RCE author: princechaddha severity: critical description: The Import XML and RS...

9.8CVSS8.9AI score0.39294EPSS
SaveExploits2References1
Nuclei
Nuclei
added 13 hours ago71 views

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

9.8CVSS8.9AI score0.56567EPSS
SaveExploits0References3
Nuclei
Nuclei
added 13 hours ago114 views

ReQlogic v11.3 - Cross Site Scripting

ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the POBatch and WaitDuration parameters. id: CVE-2022-41441 info: name: ReQlogic v11.3 - Cross Site Scripting author: r3Y3r53 severity: medium description: | ReQlogic v11.3 allow attackers ...

6.1CVSS6.5AI score0.05187EPSS
SaveExploits4References5
Nuclei
Nuclei
added 13 hours ago614 views

Laravel Filemanager v2.5.1 - Local File Inclusion

Laravel Filemanager aka UniSharp through version 2.5.1 is vulnerable to local file inclusion via download?workingdir=%2F. id: CVE-2022-40734 info: name: Laravel Filemanager v2.5.1 - Local File Inclusion author: arafatansari severity: medium description: | Laravel Filemanager aka UniSharp through...

6.5CVSS6.4AI score0.04298EPSS
SaveExploits1References5
Nuclei
Nuclei
added 13 hours ago93 views

kkFileView 4.1.0 - Cross-Site Scripting

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

6.1CVSS6.1AI score0.01157EPSS
SaveExploits1References5
Nuclei
Nuclei
added 13 hours ago85 views

WordPress InPost Gallery <2.1.4.1 - Local File Inclusion

WordPress InPost Gallery plugin before 2.1.4.1 is susceptible to local file inclusion. The plugin insecurely uses PHP's extract function when rendering HTML views, which can allow attackers to force inclusion of malicious files and URLs. This, in turn, can enable them to execute code remotely on...

9.8CVSS8.7AI score0.09519EPSS
SaveExploits2References5
Nuclei
Nuclei
added 13 hours ago72 views

Tablesome < 1.0.9 - Cross-Site Scripting

Tablesome before 1.0.9 is susceptible to cross-site scripting via the tab parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

6.1CVSS6AI score0.01067EPSS
SaveExploits3References3
Rows per page
Query Builder