Lucene search
+L

213536 matches found

Nuclei
Nuclei
added 2026/09/19 2:05 a.m.97 views

ASUS GT-AC2900 - Authentication Bypass

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handlerequest in router/httpd/httpd.c and authcheck in webhook.o. An...

9.8CVSS7.5AI score0.99393EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.102 views

WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.6.7 is susceptible to blind SQL injection. The plugin does not escape the discountcode in one of its REST routes before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

9.8CVSS8.3AI score0.81828EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.67 views

Cyber Cafe Management System 1.0 - SQL Injection

Cyber Cafe Management System 1.0 contains multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of th...

9.8CVSS8.3AI score0.22909EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.84 views

Member Hero <=1.0.9 - Remote Code Execution

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

9.8CVSS8.8AI score0.09436EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.130 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/takeaction.php?id=. id: CVE-2022-31984 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL...

7.2CVSS7.1AI score0.04906EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.78 views

WordPress ARPrice <3.6.1 - SQL Injection

WordPress ARPrice plugin prior to 3.6.1 contains a SQL injection vulnerability. It fails to properly sanitize and escape user supplied POST data before being inserted in an SQL statement and executed via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...

9.8CVSS8.3AI score0.1345EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.71 views

Kae's File Manager <=1.4.7 - Cross-Site Scripting

Kae's File Manager through 1.4.7 contains a cross-site scripting vulnerability via a crafted GET request to /kfm/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.2AI score0.01479EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.31 views

phpMyFAQ < 3.1.8 - Cross-Site Scripting

phpMyFAQ versions prior to 3.1.8 contain a reflected cross-site scripting vulnerability in the search functionality. The application fails to properly sanitize user input in the search parameter, allowing attackers to inject and execute malicious JavaScript code in the context of other users'...

7.3CVSS6.9AI score0.06132EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.113 views

BackupBuddy - Local File Inclusion

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters. id: CVE-2022-31474 info: name: BackupBuddy - Local File Inclusion author: aringo severity: high description: BackupBuddy versions 8.5.8.0 - 8.7.4...

7.5CVSS7.3AI score0.63761EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.58 views

WordPress Simple Membership <4.1.1 - Cross-Site Scripting

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. id: CVE-2022-1724 info: name: WordPress Simple Membership 4.1.1 - Cross-Site Scripting author:...

6.1CVSS6.2AI score0.01849EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.63 views

OpenCATS 0.9.7 - Cross-Site Scripting

OpenCATS 0.9.7 contains a cross-site scripting vulnerability via the component /opencats/index.php?m=settings&a=ajaxtagsupd. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based...

6.1CVSS6.1AI score0.0137EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.27 views

WordPress Gmedia Photo Gallery Plugin < 1.20.0 - Cross-Site Scripting

The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the album's name before outputting it in pages or posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting XSS attacks even when the unfiltered-html capabilit...

4.8CVSS5.6AI score0.009EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.87 views

kkFileView 4.1.0 - Cross-Site Scripting

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. id: CVE-2022-35151 info: name: kkFileView 4.1.0 - Cross-Site Scripting author: arafatansari severity: medium description: | kkFileView 4.1.0...

6.1CVSS6.2AI score0.01361EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.34 views

74cmsSE v3.4.1 - Arbitrary File Read

74cmsSE v3.4.1 was discovered to contain an arbitrary file read vulnerability via the $url parameter at \index\controller\Download.php. id: CVE-2022-26271 info: name: 74cmsSE v3.4.1 - Arbitrary File Read author: ritikchaddha severity: high description: | 74cmsSE v3.4.1 was discovered to contain a...

7.5CVSS7.6AI score0.04515EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.44 views

WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting

The plugin was affected by a reflected cross-site scripting vulnerability in the wooce admin page. id: CVE-2022-0149 info: name: WooCommerce Stored Exporter WordPress Plugin 2.7.1 - Cross-Site Scripting author: dhiyaneshDk severity: medium description: The plugin was affected by a reflected...

6.1CVSS6.1AI score0.02337EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.66 views

WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting

WordPress Embed Swagger plugin 1.0.0 and prior contains a reflected cross-site scripting vulnerability due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file, which allows attackers to inject arbitrary web scripts onto the page. id:...

6.1CVSS6.2AI score0.03865EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.99 views

Download Monitor <= 4.7.60 - Sensitive Information Exposure

The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...

7.5CVSS7.4AI score0.38083EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.73 views

Open edX <2022-06-06 - Cross-Site Scripting

Open edX before 2022-06-06 contains a reflected cross-site scripting vulnerability via the 'next' parameter in the logout URL. id: CVE-2022-32195 info: name: Open edX 2022-06-06 - Cross-Site Scripting author: arafatansari severity: medium description: | Open edX before 2022-06-06 contains a...

6.1CVSS6.2AI score0.02407EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.83 views

Formcraft3 <3.8.28 - Server-Side Request Forgery

Formcraft3 before version 3.8.2 does not validate the URL parameter in the formcraft3get AJAX action, leading to server-side request forgery issues exploitable by unauthenticated users. id: CVE-2022-0591 info: name: Formcraft3 3.8.28 - Server-Side Request Forgery author: Akincibor,j4vaovo severit...

9.1CVSS8AI score0.20249EPSS
SaveExploits2References2
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.119 views

MCMS 5.2.4 - SQL Injection

MCMS 5.2.4 contains a SQL injection vulnerability via search.do in the file /mdiy/dict/listExcludeApp. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. id: CVE-2022-25125 info: name: MCMS...

9.8CVSS8.2AI score0.06981EPSS
SaveExploits1References3
Rows per page
Query Builder