Lucene search
+L

70007 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.101 views

Cisco Smart Licensing Utility UnAuthenticated Logs Exposure Leaking Plaintext Credentials

A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.This vulnerability is due to excessive verbosity in a debug log file. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected...

7.5CVSS8.4AI score0.51897EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.51 views

Mitel MiCollab <= 9.8.0.33 - SQL Injection

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

9.8CVSS8.4AI score0.9811EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.76 views

pgAdmin 4 - Authentication Bypass

pgAdmin 4 versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the client ID and secret, leading to unauthorized access to user data. id: CVE-2024-9014 info: name: pgAdmin 4 - Authentication Bypass author...

9.9CVSS8AI score0.09685EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.88 views

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure

A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is...

8.7CVSS5.6AI score0.03692EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.92 views

TeamPass 2.1.27.36 - Improper Authentication

TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2020-12478 info...

7.5CVSS6.7AI score0.08552EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.56 views

Active Directory Integration WP Plugin < 4.1.10 - Log Disclosure

The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. id:...

7.5CVSS7.4AI score0.25855EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.123 views

Modoboa < 2.1.0 - Improper Authorization

Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. id: CVE-2023-2227 info: name: Modoboa 2.1.0 - Improper Authorization author: ritikchaddha,princechaddha severity: critical description: | Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. impact:...

9.1CVSS8.1AI score0.44029EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.49 views

MLFlow < 2.8.1 - Sensitive Information Disclosure

An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. id: CVE-2023-43472 info: name: MLFlow 2.8.1 - Sensitive Information Disclosure author: ritikchaddha severity: high description: | An issue in MLFlow versions...

7.5CVSS7.3AI score0.36582EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.52 views

Sensei LMS < 4.24.2 - Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. id: CVE-2024-7786 info: name: Sensei LMS 4.24.2 - Email Template Leak author: s4e-io severity: high description: | The Sensei LMS WordPress...

7.5CVSS5.5AI score0.01745EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.119 views

DataEase <= 2.4.1 - Sensitive Information Exposure

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. id: CVE-2024-30269...

5.3CVSS5.7AI score0.15875EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.124 views

Drupal 11.x-dev - Full Path Disclosure

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. id: CVE-2024-45440 info: name: Drupal 11.x-dev - Full Path Disclosure author: DhiyaneshDK severity: medium description: |...

5.3CVSS5.9AI score0.09269EPSS
SaveExploits4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.91 views

WordPress Download Manager - File Password Exposure

The WordPress Download Manager plugin contains a vulnerability that allows attackers to obtain passwords for password-protected downloads by sending a specially crafted request to the validate-password API endpoint. id: CVE-2023-6421 info: name: WordPress Download Manager - File Password Exposure...

7.5CVSS7.2AI score0.02437EPSS
SaveExploits3References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.90 views

All-in-One WP Migration < 7.87 - Unauthenticated Information Disclosure

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to unauthenticated information disclosure due to its error.log file being publicly accessible in versions before 7.87. id: CVE-2024-8852 info: name: All-in-One WP Migration 7.87 - Unauthenticated Information Disclosure...

5.3CVSS5.7AI score0.01207EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.161 views

FXServer < v9601 - Information Exposure

Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint. id: CVE-2024-46310 info: name: FXServer v9601 - Information Exposure author: s4e-io severity: medium description: | Incorrect Access...

9.1CVSS5.9AI score0.02482EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.21 views

OpenProject < 12.5.4 - Project Identifiers Exposure

OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication. id: CVE-2023-33960 info: name: OpenProject 12.5.4 - Project...

7.5CVSS7.2AI score0.01257EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.135 views

Imgproxy < 3.27.2 - Server-Side Request Forgery (SSRF)

imgproxy contains an issue caused by not blocking the 0.0.0.0 address even when IMGPROXYALLOWLOOPBACKSOURCEADDRESSES is set to false, letting local services be exposed, exploit requires network access. id: CVE-2025-24354 info: name: Imgproxy 3.27.2 - Server-Side Request Forgery SSRF author:...

5.3CVSS6.9AI score0.00868EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.33 views

Electrolink FM/DAB/TV Transmitter - Credentials Disclosure

A credential exposure vulnerability in Electrolink 500W, 1kW, 2kW Medium DAB Transmitter Web v01.09, v01.08, v01.07, and Display v1.4, v1.2 allows unauthorized attackers to access credentials in plaintext. id: CVE-2025-28228 info: name: Electrolink FM/DAB/TV Transmitter - Credentials Disclosure...

7.5CVSS5.7AI score0.01774EPSS
SaveExploits1References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.47 views

Trinity Audio <= 5.21.0 - Information Exposure

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

5.3CVSS5.7AI score0.01005EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.42 views

RestroPress 3.0.0-3.2.1 - Authentication Bypass

RestroPress Online Food Ordering System WordPress plugin 3.0.0 to 3.1.9.2 contains an authentication bypass caused by exposure of user private tokens and API data via /wp-json/wp/v2/users endpoint, letting unauthenticated attackers forge JWT tokens and authenticate as other users including...

9.8CVSS8.1AI score0.02334EPSS
SaveExploits6References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.16 views

LottieFiles for Gutenberg <= 3.0.0 - Unauthenticated Settings Disclosure

The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the /wp-json/lottiefiles/v1/settings/ REST API endpoint. This makes it possible for unauthenticated attackers to retrieve the site...

5.3CVSS5.5AI score0.00699EPSS
SaveExploits0References3
Rows per page
Query Builder