Lucene search
+L

225950 matches found

Nuclei
Nuclei
added 2026/08/23 2:28 a.m.50 views

Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion

A directory traversal vulnerability in the MT Fire Eagle commtfireeagle component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1719 info: name: Joomla! Component ...

6.8CVSS5.8AI score0.09371EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.50 views

Joomla! Component Advertising 0.25 - Local File Inclusion

A directory traversal vulnerability in the Advertising comadvertising component 0.25 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1473 info: name: Joomla! Component...

6.8CVSS5.8AI score0.08163EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.105 views

Accela Civic Platform <=21.1 - Cross-Site Scripting

Accela Civic Platform through 21.1 contains a cross-site scripting vulnerability via ssoAdapter/logoutAction.do successURL. id: CVE-2021-34370 info: name: Accela Civic Platform 21.1 that includes proper input validation and sanitization. reference: - https://www.exploit-db.com/exploits/49990 -...

6.1CVSS5.7AI score0.09996EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.56 views

HotelDruid 2.3.0 - Cross-Site Scripting

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. id: CVE-2019-8937 info: name: HotelDruid 2.3.0 - Cross-Site Scripting author: LogicalHunte...

6.1CVSS5.5AI score0.10633EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.53 views

WordPress Download Manager <2.9.94 - Cross-Site Scripting

WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter. id: CVE-2019-15889 info: name: WordPress Download Manager 2.9.94 - Cross-Site Scripting author: daffainf...

6.1CVSS5.6AI score0.11375EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.56 views

Microstrategy Web 7 - Cross-Site Scripting

Microstrategy Web 7 does not sufficiently encode user-controlled inputs, resulting in cross-site scripting via the Login.asp Msg parameter. id: CVE-2018-18775 info: name: Microstrategy Web 7 - Cross-Site Scripting author: 0xAkoko severity: medium description: Microstrategy Web 7 does not...

6.1CVSS5.6AI score0.07905EPSS
SaveExploits5References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.103 views

openSIS Student Information System 8.0 SQL Injection

openSIS Student Information System version 8.0 is susceptible to SQL injection via the studentid and TRANSFERSCHOOL parameters in POST request sent to /TransferredOutModal.php. id: CVE-2021-41691 info: name: openSIS Student Information System 8.0 SQL Injection author: Bartu Utku SARP severity: hi...

9.8CVSS6.5AI score0.01723EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.58 views

WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting

WordPress W3 Total Cache plugin before 2.1.4 is susceptible to cross-site scripting within the extension parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This can allow an attacker to convince an authenticated admin into clicking a link to run...

6.1CVSS5.7AI score0.01905EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.91 views

XStream <1.4.18 - Server-Side Request Forgery

XStream before 1.4.18 is susceptible to server-side request forgery. An attacker can request data from internal resources that are not publicly available by manipulating the processed input stream with a Java runtime version 14 to 8. This makes it possible to obtain sensitive information, modify...

8.5CVSS7.2AI score0.11377EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.102 views

Kavita <0.5.4.1 - Server-Side Request Forgery

Kavita before 0.5.4.1 is susceptible to server-side request forgery in GitHub repository kareadita/kavita. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-2756 info: name:...

7.1CVSS6.8AI score0.03109EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.56 views

Monstra CMS <=3.0.4 - Cross-Site Scripting

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

6.1CVSS6.7AI score0.04733EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.68 views

Microstrategy Web 7 - Local File Inclusion

Microstrategy Web 7 is vulnerable to local file inclusion via "/WebMstr7/servlet/mstrWeb" in the parameter subpage. Remote authenticated users can bypass intended SecurityManager restrictions and list a parent directory via a /.. slash dot dot in a pathname used by a web application. NOTE: this i...

4.3CVSS4.8AI score0.22768EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.106 views

Rstudio Shiny Server <1.5.16 - Local File Inclusion

Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL. id: CVE-2021-3374 info: name: Rstudio Shiny Server 1.5.16 - Local File Inclusion author: geeknik severity: medium description: Rstudi...

5.3CVSS5.6AI score0.14424EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.161 views

Wavlink WN535K2/WN535K3 - OS Command Injection

Wavlink WN535K2 and WN535K3 routers are susceptible to OS command injection in /cgi-bin/touchlistsync.cgi via manipulation of the argument IP. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

9.8CVSS8.8AI score0.32947EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.79 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD through version 4.11.01 is vulnerable to cross-site scripting via the /assets/add/category.php CatagoryName and StakeHolder parameters. id: CVE-2018-20011 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD through version...

4.8CVSS5.3AI score0.04428EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.33 views

Joomla! Component Address Book 1.5.0 - Local File Inclusion

A directory traversal vulnerability in the AddressBook comaddressbook component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1471 info: name: Joomla! Component Address Book 1.5.0 - Local File Inclusion...

7.5CVSS5.6AI score0.16152EPSS
SaveExploits3References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.87 views

qdPM 9.1 - Cross-site Scripting

qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter. id: CVE-2019-8390 info: name: qdPM 9.1 - Cross-site Scripting author: theamanrawat severity: medium description: | qdPM 9.1 suffers from Cross-site Scripting XSS in the searchkeywords parameter. impact: | Successful...

6.1CVSS5.9AI score0.09836EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.227 views

FortiLogger 4.4.2.2 - Arbitrary File Upload

FortiLogger 4.4.2.2 is affected by arbitrary file upload issues. Attackers can send a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then Assets/temp/hotspot/img/logohotspot.asp. id: CVE-2021-3378 info: name: FortiLogger 4.4.2.2 - Arbitrary File Upload author:...

9.8CVSS8.9AI score0.97512EPSS
SaveExploits8References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.48 views

PHPGurukul Hospital Management System - Cross-Site Scripting

PHPGurukul Hospital Management System in PHP 4.0 contains multiple cross-site scripting vulnerabilities. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2020-5191 info: name: PHPGurukul Hospital Management System -...

6.1CVSS6.2AI score0.0552EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.62 views

Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion

Joomla! Omilen Photo Gallery comomphotogallery component Beta 0.5 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the controller parameter to index.php. id: CVE-2009-4202 info: name: Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion...

7.5CVSS5.6AI score0.08109EPSS
SaveExploits2References5
Rows per page
Query Builder