Lucene search
+L

624322 matches found

Nuclei
Nuclei
added 2026/08/27 4:24 a.m.124 views

Cloudpanel 2 < 2.3.1 - Remote Code Execution

CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. id: CVE-2023-35885 info: name: Cloudpanel 2 2.3.1 - Remote Code Execution author: DhiyaneshDk severity: critical description: | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. impact: | Successfu...

9.8CVSS8.7AI score0.74888EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.23 views

Tenda AC15 AC1900 version 15.03.05.19 - Command Injection

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter. id: CVE-2020-10987 info: name: Tenda AC15 AC1900 version 15.03.05.19 - Command Injection author: pussycat0x severity: critical...

10CVSS9.5AI score0.7981EPSS
SaveExploits2References1
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.127 views

pfSense pfBlockerNG <=2.1..4_26 - OS Command Injection

pfSense pfBlockerNG through 2.1.426 is susceptible to OS command injection via root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected. id: CVE-2022-31814 info: name: pfSense pfBlockerNG =2.1..427 to mitigate this vulnerability. reference: -...

9.8CVSS8.6AI score0.87798EPSS
SaveExploits14References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.428 views

Jorani 1.0.0 - Remote Code Execution

Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. id: CVE-2023-26469 info: name: Jorani 1.0.0 - Remote Code Execution author: pussycat0x severity: critical description: | Jorani 1.0.0, an attacker could leverage path traversal to access files...

9.8CVSS8.9AI score0.82949EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.24 views

VMware vRealize Log Insight - Improper Access Control to RCE

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. id: CVE-2022-31704 info: name: VMware vRealize Log Insight - Improper Acces...

9.8CVSS9.3AI score0.81011EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.115 views

Wordpress Tatsubuilder <= 3.3.11 - Remote Code Execution

An unrestricted file upload in WordPress Tatsubuilder plugin version = 3.3.11 enables an unauthenticated attacker to perform a remote code execution RCE on the server host due to multiple weaknesses in the font import feature and put 100,000 websites at risk. id: CVE-2021-25094 info: name:...

8.1CVSS8.6AI score0.83354EPSS
SaveExploits9References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.19 views

Sunflower Simple and Personal 1.0.1.43315 - Remote Code Execution

Sunlogin Sunflower Simplified aka Sunflower Simple and Personal 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker can execute arbitrary programs on the victim host by sending a crafted HTTP request, as demonstrated by /check?cmd=ping../ followed by the...

9.8CVSS9.1AI score0.56787EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.218 views

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

9.8CVSS9.5AI score0.74519EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.125 views

vBulletin <= 5.6.9 - Pre-authentication Remote Code Execution

vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. This occurs because verifyserialized checks that a value is serialized by calling unserialize and then checking for errors. id: CVE-2023-25135...

9.8CVSS9.3AI score0.23926EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.181 views

Spring Security OAuth2 Remote Command Execution

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

8.8CVSS8.3AI score0.79176EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.44 views

Trixbox - 2.8.0.4 OS Command Injection

Trixbox 2.8.0.4 is vulnerable to OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php. id: CVE-2017-14535 info: name: Trixbox - 2.8.0.4 OS Command Injection author: pikpikcu severity: high description: Trixbox 2.8.0.4 is vulnerable to OS command...

9CVSS8.2AI score0.50069EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.285 views

JetBrains TeamCity > 2023.11.3 - Authentication Bypass

In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible id: CVE-2024-23917 info: name: JetBrains TeamCity 2023.11.3 - Authentication Bypass author: iamnoooob,rootxharsh,pdresearch severity: critical description: | In JetBrains TeamCity before 2023.11.3...

9.8CVSS9.1AI score0.5373EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.52 views

Netgear R6850 V1.1.0.88 - Command Injection

Netgear R6850 router firmware version V1.1.0.88 suffers from a command injection vulnerability in the pingtest functionality. An unauthenticated attacker can inject arbitrary system commands through the c4IPAddr parameter, resulting in remote code execution as root. id: CVE-2024-30568 info: name:...

9.8CVSS6.5AI score0.46918EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.11 views

IBM Langflow - Remote Code Execution

IBM Langflow OSS 1.0.0 through 1.10.0 contains a remote code execution caused by chaining /api/v1/autologin and /api/v1/validate/code endpoints, letting unauthenticated attackers execute arbitrary code remotely, exploit requires no authentication. id: CVE-2026-9198 info: name: IBM Langflow - Remo...

9.8CVSS9.9AI score0.34734EPSS
SaveExploits7References4
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.170 views

Unauthenticated Remote Code Execution – Bricks <= 1.9.6

Bricks Builder is a popular WordPress development theme with approximately 25,000 active installations. It provides an intuitive drag-and-drop interface for designing and building WordPress websites. Bricks = 1.9.6 is vulnerable to unauthenticated remote code execution RCE which means that anybod...

10CVSS9.8AI score0.88234EPSS
SaveExploits19References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.91 views

Issabel Authenticated - Remote Code Execution

A vulnerability was found in Issabel PBX 4.0.0. It has been rated as critical. This issue affects some unknown processing of the file /index.php?menu=asteriskcli of the component Asterisk-Cli. The manipulation of the argument Command leads to os command injection. The attack may be initiated...

9.8CVSS5.2AI score0.58153EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.155 views

Nodejs Squirrelly - Remote Code Execution

Nodejs Squirrelly is susceptible to remote code execution. Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. Squirrelly mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuratio...

8.8CVSS8.9AI score0.59844EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.202 views

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...

7.5CVSS7.7AI score0.51653EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.127 views

WordPress BackupGuard <1.6.0 - Authenticated Arbitrary File Upload

WordPress Backup Guard plugin before 1.6.0 is susceptible to authenticated arbitrary file upload. The plugin does not ensure that imported files are in SGBP format and extension, allowing high-privilege users to upload arbitrary files, including PHP, possibly leading to remote code execution. id:...

7.2CVSS8.2AI score0.84112EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/08/27 4:24 a.m.70 views

TP-Link TL-WR840N - Command Injection

The TP-Link TL-WR840NESV6.20180709 router contains a command injection vulnerability in the oalsetIp6DefaultRoute component. This vulnerability allows authenticated attackers to execute arbitrary system commands, leading to complete device compromise. id: CVE-2022-25061 info: name: TP-Link...

9.8CVSS8.2AI score0.58431EPSS
SaveExploits1References5
Rows per page
Query Builder