Lucene search
+L

213550 matches found

Nuclei
Nuclei
added 2026/09/19 2:05 a.m.71 views

Motorola Baby Monitors - Remote Command Execution

Motorola Baby Monitors contains multiple interface vulnerabilities could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-3577 info: name: Motorola Baby Monitors - Remote Command Execution author: gy741 severity: high...

8.8CVSS8AI score0.60158EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.99 views

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. id: CVE-2021-40149 info: name: Reolink E1 Zoom Camera =3.0.0.716 - Private Key Disclosure author: For3stCo1d severity: medium description: | Reolink E1 Zoom Camera versions 3.0.0.716 and...

5.9CVSS7AI score0.07931EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.84 views

Plus Addons for Elementor Page Builder < 4.1.10 - Open Redirect

WordPress Plus Addons for Elementor Page Builder before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-24358 info: name: Plus Addons for Elementor Page Builder 4.1.10 - Open Redirect...

6.1CVSS5.9AI score0.02295EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.133 views

Ghost CMS <=4.32 - Cross-Site Scripting

Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code. id: CVE-2021-29484 info: name: Ghost CMS =4.32 - Cross-Site...

6.8CVSS6.6AI score0.07935EPSS
SaveExploits1References7
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.50 views

RegistrationMagic <= 5.0.1.7 - Authentication Bypass

RegistrationMagic WordPress plugin versions = 5.0.1.7 contain an authentication bypass caused by missing identity validation in socialloginusingemail, letting unauthenticated users log in as any site user, exploit requires knowing a valid username. id: CVE-2021-4073 info: name: RegistrationMagic ...

9.8CVSS7.4AI score0.07EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.135 views

NetBiblio WebOPAC - Cross-Site Scripting

NetBiblio WebOPAC before 4.0.0.320 is affected by a reflected cross-site scripting vulnerability in its Wikipedia module through /NetBiblio/search/shortview via the searchTerm parameter. id: CVE-2021-42551 info: name: NetBiblio WebOPAC - Cross-Site Scripting author: compr00t severity: medium...

6.1CVSS6.2AI score0.02671EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.193 views

GenieACS => 1.2.8 - OS Command Injection

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check. id: CVE-2021-46704 info:...

9.8CVSS8.1AI score0.21901EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.88 views

WordPress AcyMailing <7.5.0 - Open Redirect

WordPress AcyMailing plugin before 7.5.0 contains an open redirect vulnerability due to improper sanitization of the redirect parameter. An attacker turning the request from POST to GET can craft a link containing a potentially malicious landing page and send it to the user. id: CVE-2021-24288...

6.1CVSS6.3AI score0.01939EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.93 views

Pie Register < 3.7.1.6 - Unauthenticated Arbitrary Login

The Registration Forms User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allowing unauthenticated attacker to login as any user on the site by only knowing their user ID or username...

8.1CVSS7.3AI score0.0983EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.97 views

ASUS GT-AC2900 - Authentication Bypass

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handlerequest in router/httpd/httpd.c and authcheck in webhook.o. An...

9.8CVSS7.5AI score0.99393EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.102 views

WordPress Paid Memberships Pro <2.6.7 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.6.7 is susceptible to blind SQL injection. The plugin does not escape the discountcode in one of its REST routes before using it in a SQL statement. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

9.8CVSS8.3AI score0.81828EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.67 views

Cyber Cafe Management System 1.0 - SQL Injection

Cyber Cafe Management System 1.0 contains multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of th...

9.8CVSS8.3AI score0.22909EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.84 views

Member Hero <=1.0.9 - Remote Code Execution

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

9.8CVSS8.8AI score0.09436EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.130 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/requests/takeaction.php?id=. id: CVE-2022-31984 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL...

7.2CVSS7.1AI score0.04906EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.78 views

WordPress ARPrice <3.6.1 - SQL Injection

WordPress ARPrice plugin prior to 3.6.1 contains a SQL injection vulnerability. It fails to properly sanitize and escape user supplied POST data before being inserted in an SQL statement and executed via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or...

9.8CVSS8.3AI score0.1345EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.71 views

Kae's File Manager <=1.4.7 - Cross-Site Scripting

Kae's File Manager through 1.4.7 contains a cross-site scripting vulnerability via a crafted GET request to /kfm/index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

6.1CVSS6.2AI score0.01479EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.31 views

phpMyFAQ < 3.1.8 - Cross-Site Scripting

phpMyFAQ versions prior to 3.1.8 contain a reflected cross-site scripting vulnerability in the search functionality. The application fails to properly sanitize user input in the search parameter, allowing attackers to inject and execute malicious JavaScript code in the context of other users'...

7.3CVSS6.9AI score0.06132EPSS
SaveExploits3References3
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.113 views

BackupBuddy - Local File Inclusion

BackupBuddy versions 8.5.8.0 - 8.7.4.1 are vulnerable to a local file inclusion vulnerability via the 'download' and 'local-destination-id' parameters. id: CVE-2022-31474 info: name: BackupBuddy - Local File Inclusion author: aringo severity: high description: BackupBuddy versions 8.5.8.0 - 8.7.4...

7.5CVSS7.3AI score0.63761EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.58 views

WordPress Simple Membership <4.1.1 - Cross-Site Scripting

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. id: CVE-2022-1724 info: name: WordPress Simple Membership 4.1.1 - Cross-Site Scripting author:...

6.1CVSS6.2AI score0.01849EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/19 2:05 a.m.63 views

OpenCATS 0.9.7 - Cross-Site Scripting

OpenCATS 0.9.7 contains a cross-site scripting vulnerability via the component /opencats/index.php?m=settings&a=ajaxtagsupd. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site, which can allow the attacker to steal cookie-based...

6.1CVSS6.1AI score0.0137EPSS
SaveExploits1References3
Rows per page
Query Builder