Lucene search
+L

627635 matches found

Nuclei
Nuclei
added 2026/09/05 2:04 a.m.34 views

NUUO Camera <=20250203 - OS Command Injection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. id: CVE-2025-1338 info: name: NUUO Camera =20250203 - OS Command Injection author: Ark...

7.5CVSS7.9AI score0.51397EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.8 views

mJobTime <= 15.7.2 - Unauthenticated Blind SQL Injection to RCE

mJobtime v15.7.2 contains a sql injection caused by crafted POST request to /Default.aspx/updateprofileServer, letting unauthenticated attackers execute arbitrary SQL statements remotely, exploit requires no special privileges. id: CVE-2025-51683 info: name: mJobTime = 15.7.2 - Unauthenticated...

9.8CVSS6AI score0.018EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.25 views

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

8.8CVSS5.8AI score0.3436EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.24 views

Zeroshell 3.9.3 - Command Injection

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character. id: CVE-2020-29390 info: name: Zeroshell 3.9.3 - Command...

10CVSS8.9AI score0.39565EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.84 views

Contact Form 7 Drag and Drop Multiple File Upload - Arbitrary File Upload

The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and including, 1.3.8.9. This makes it possible for unauthenticated attackers to bypass the plugin's blacklist and...

9.8CVSS6.5AI score0.0509EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.342 views

Sitecore - Remote Code Execution

Multiple Sitecore products allow remote code execution. This affects Experience Manager, Experience Platform, and Experience Commerce through 10.3. id: CVE-2023-35813 info: name: Sitecore - Remote Code Execution author: DhiyaneshDk,iamnoooob severity: critical description: | Multiple Sitecore...

9.8CVSS9.1AI score0.86685EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.104 views

Plenti < v0.7.2 - OS Command Injection

Plenti, a static site generator, has an arbitrary file write vulnerability in versions prior to 0.7.2. The /postLocal endpoint is vulnerable to an arbitrary file write vulnerability when a plenti user serves their website. This issue may lead to Remote Code Execution. Version 0.7.2 fixes the...

9.3CVSS7.8AI score0.02705EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.141 views

Imgproxy <= 3.14.0 - Server-side request forgery (SSRF)

imgproxy =3.14.0 is vulnerable to Server-Side Request Forgery SSRF due to a lack of sanitization of the imageURL parameter. id: CVE-2023-30019 info: name: Imgproxy = 3.14.0 - Server-side request forgery SSRF author: DhiyaneshDK severity: medium description: | imgproxy =3.14.0 is vulnerable to...

5.3CVSS5.5AI score0.02214EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.197 views

OpenCode < 1.0.216 - Unauthenticated Remote Code Execution

OpenCode versions prior to 1.0.216 contain an unauthenticated remote code execution vulnerability. The application exposes session and shell execution endpoints without proper authentication, allowing remote attackers to create sessions and execute arbitrary shell commands on the underlying serve...

8.8CVSS9.6AI score0.17326EPSS
SaveExploits8References2
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.41 views

WordPress Super Forms <= 6.3.313 - Arbitrary File Upload

Super Forms – Drag & Drop Form Builder WordPress plugin \u003C= 6.3.313 contains an arbitrary file upload vulnerability caused by missing file type validation and lack of capability checks in submitform nopriv AJAX handler, letting unauthenticated attackers upload executable files and achieve...

9.8CVSS6.4AI score0.05265EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.148 views

Viessmann Vitogate 300 - Remote Code Execution

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. id: CVE-2023-45852 info: name: Viessmann Vitogate 300 - Remote Code Execution autho...

9.8CVSS7.5AI score0.14003EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.65 views

Eaton Intelligent Power Manager 1.6 - Directory Traversal

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. id: CVE-2018-12031 info: name: Eaton Intelligent Power Manager 1.6 - Directory Traversal author: daffainfo...

9.8CVSS8.8AI score0.05602EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.58 views

WP GDPR Compliance < 1.4.3 - Unauthenticated Call Any Action or Update Any Option

The WP GDPR Compliance plugin allows unauthenticated users to execute any action and update any database value. This vulnerability is due to the lack of proper validation in the Includes/Ajax.php file. id: CVE-2018-19207 info: name: WP GDPR Compliance 1.4.3 - Unauthenticated Call Any Action or...

9.8CVSS8.8AI score0.85176EPSS
SaveExploits4References2
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.31 views

LG Supersign EZ CMS - Remote Code Execution

LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsrserver/device/getThumbnail. id: CVE-2018-17173 info: name: LG Supersign EZ CMS - Remote Code Execution author: pussycat0x severity: critical description: | LG SuperSign CMS allows remote attackers...

9.8CVSS9.7AI score0.26689EPSS
SaveExploits9References4
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.66 views

FlexPaper/FlowPaper 2.3.6 - Remote Code Execution

The Publish Service in FlexPaper later renamed FlowPaper 2.3.6 allows remote code execution via setup.php and changeconfig.php. id: CVE-2018-11686 info: name: FlexPaper/FlowPaper 2.3.6 - Remote Code Execution author: iamnoooob,pdresearch,pszyszkowski severity: critical description: | The Publish...

9.8CVSS9.6AI score0.32021EPSS
SaveExploits4References1
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.80 views

elFinder < 2.1.58 - Remote Code Execution

studio-42/elfinder before 2.1.58 contains a remote code execution caused by execution of PHP code in a .phar file, letting attackers execute arbitrary PHP code if the server parses .phar files as PHP, exploit requires server to parse .phar files as PHP. id: CVE-2021-23394 info: name: elFinder...

9.8CVSS9.7AI score0.18935EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.114 views

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

10CVSS9.1AI score0.69882EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.92 views

Gryphon Tower - Cross-Site Scripting

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

6.1CVSS6AI score0.02557EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.101 views

Nagios XI 5.5.6-5.7.5 - Authenticated Remote Command Injection

Nagios XI 5.5.6 through 5.7.5 is susceptible to authenticated remote command injection. There is improper sanitization of authenticated user-controlled input by a single HTTP request via the file /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php. This in turn can lead ...

9CVSS8.5AI score0.72182EPSS
SaveExploits7References5
Nuclei
Nuclei
added 2026/09/05 2:04 a.m.155 views

Spring Cloud Netflix Hystrix Dashboard <2.2.10 - Remote Code Execution

Spring Cloud Netflix Hystrix Dashboard prior to version 2.2.10 is susceptible to remote code execution. Applications using both spring-cloud-netflix-hystrix-dashboard and spring-boot-starter-thymeleaf expose a way to execute code submitted within the request URI path during the resolution of view...

8.8CVSS8.4AI score0.13035EPSS
SaveExploits0References5
Rows per page
Query Builder